# Phase 6: Lessons Learned

Often skipped but incredibly vital, the "Lessons Learned" phase is where the organization improves its defenses based on the failures of the past.

## The Post-Incident Report
Within two weeks of closing the incident, the Incident Response team must produce a comprehensive written report.
*   **The Timeline:** A blow-by-blow, minute-by-minute account of exactly what the attacker did, and exactly how the defense team responded.
*   **Root Cause Analysis:** Precisely how the attacker gained initial access (The "Patient Zero" vector). E.g., *"Employee Bob Smith clicked a link in a phishing email on Tuesday."*
*   **The Impact:** Exactly what data was stolen, how much money was lost, and the total downtime of the business. (This is usually required for cyber insurance claims and legal/regulatory compliance).

## The Post-Mortem Meeting
The IR team holds a meeting with executives and IT managers to brutally honestly evaluate the response.

*   *What went right?* (e.g., the EDR tool successfully blocked the ransomware from spreading past the initial host).
*   *What went wrong?* (e.g., it took the SOC 14 hours to notice the alert; the backups for the HR database were corrupted and failed to restore).

## Continuous Improvement
The ultimate goal of this phase is actionable change to ensure the same attack never succeeds again.
*   If the attacker used a stolen password, the business implements mandatory Multi-Factor Authentication (MFA). 
*   If the IR team didn't know how to contain the threat quickly, the business rewrite the playbooks and funds more tabletop training exercises.
*   The output of "Lessons Learned" feeds directly back into Phase 1, "Preparation", creating a continuous loop of strengthening security.