CISSP-ISSMP: Information Systems Security Management Professional

Post-incident lessons learned are used to close the security gaps exposed by an incident and to improve future response. Improvements can include revising incident-information dissemination and electronic-monitoring policies, strengthening personnel security controls, and updating the incident response plan to address problems encountered during its execution. NIST guidance likewise calls for incorporating lessons learned into incident response procedures, training, and testing, and for updating the incident response plan when implementation or execution reveals problems.