SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-lessons-learned-meeting

What is the purpose of a lessons learned meeting after a major security incident?

To review how the response went and identify improvements to controls and practices.

Start playing free

  1. Review the response and identify improvements ✔
  2. Assign blame to one person
  3. Delete all evidence of the incident

Why: Lessons learned closes the loop. The team reviews what worked, what failed and what to change. The results feed back into preparation for the next incident.

Huh, didn't know that: NIST's 2025 guidance says lessons learned should often be shared as soon as they are found, not held until recovery ends.

The dad joke
Our lessons learned meeting lasted two hours. The main lesson: don't hold two-hour meetings.
Like this card?
Play the game

References

Answer: Review the response and identify improvements. Lessons learned closes the loop. The team reviews what worked, what failed and what to change. The results feed back into preparation for the next incident.

  1. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
    the organization should hold a lessons learned meeting to review the effectiveness of the incident handling process
    Checked 2026-10-10.
  2. NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
    should often be shared as soon as they are identified, not delayed until after recovery concludes
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIn NIST's classic incident response life cycle (SP 800-61 Rev. 2), which phase follows Detection and Analysis?Security & PrivacyWhat is a tabletop exercise in incident response planning?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?

That's stuff everyone should know.