## Phase 5: Post-Incident Activity - The Debrief

The dust has settled. The bad guys are gone. Time for the "Hot Wash" or "Post-Mortem".

### The Report
You must produce a final Incident Report.
*   **Executive Summary**: Non-technical. "We were hacked. It cost $50k. It's over. Here is the risk."
*   **Timeline**: detailed, second-by-second account.
*   **Technical Findings**: How they got in (Root Cause), what they took.
*   **Recommendations**: The "To-Do" list to fix the holes.

### The Root Cause Analysis (RCA)
Use the "5 Whys" technique.
*   **Problem**: Server was hacked.
    *   *Why?* Vulnerability in Apache was exploited.
    *   *Why?* It wasn't patched.
    *   *Why?* The patching script failed.
    *   *Why?* The server disk was full, so the update failed.
    *   *Why?* No one monitors disk space on Dev servers.
*   **Root Cause**: Lack of monitoring on Dev servers.
*   **Fix**: Implement monitoring on all servers.

### Updating the Organization
*   **Metrics**: Time to Detect (TTD), Time to Respond (TTR). Did we improve?
*   **Playbook Updates**: "Our Ransomware playbook didn't say who to call at the ISP. We wasted 1 hour finding the number. Update the playbook."
*   **Evidence Retention**: How long do we keep the forensic images? (Usually years, for legal reasons).

### Closing
The goal of this phase is not to blame (Finger Pointing), but to improve (System Strengthening). If you skip this, you WILL be hacked again by the same technique.