Most organizations hold a post-incident review. Fewer can show that its actions were closed and that the fix works. The review meeting is the easy part. The hard part is the six months after, when the incident fades, the owners move on and the actions sit in a tracker. This playbook turns a review into closed, verified actions.
What the standards say
NIST SP 800-61 Revision 3 (April 2025) changes how incident response and improvement fit together. It says the older model treated post-incident work as a stage after recovery. Today, it says, incidents are frequent and damaging, recovery can take weeks or months, and lessons learned should often be shared as soon as they are identified, not held until recovery ends. It maps this to the CSF 2.0 Improvement category, ID.IM.
| CSF 2.0 outcome | Meaning | Note from NIST SP 800-61r3 |
|---|---|---|
| ID.IM-01 | Improvements are identified from evaluations | - |
| ID.IM-02 | Improvements are identified from security tests and exercises, including with suppliers and third parties | - |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures and activities | Includes all incident response and recovery; improvements are often found in follow-up reports and lessons-learned meetings, especially after a major incident |
| ID.IM-04 | Incident response and other cybersecurity plans that affect operations are established, communicated, maintained and improved | Recommends keeping business continuity plans in step with incident response plans and reviewing plans periodically or when significant improvements are identified |
What a UAE-regulated bank must now do
CBUAE regulation C 1/2026 (Rulebook header: effective 14 September 2026) is specific. Article 9.2 requires a licensed financial institution to regularly review, test and update its incident response and recovery plans based on lessons learned, and to identify and address the root cause of all material Incidents, with measures to prevent them or reduce their likelihood. Article 9.4.4 requires communication plans to include analysis with lessons learned after an Incident has been resolved. Article 7.11.5 requires operational risk reports to include details of significant events and losses with a root cause analysis.
Why closure matters: the NHS and WannaCry
The UK National Audit Office’s investigation (HC 414) says the Department of Health was warned about cyber risks to the NHS a year before WannaCry. The National Data Guardian and CQC reports were published in July 2016, and the Department did not formally respond with a written report until July 2017. Before the attack, NHS Digital had conducted on-site assessments of 88 of 236 trusts and none had passed. The NAO also records that NHS Digital could not mandate local bodies to take remedial action. At least 80 of 236 trusts were affected. Our reading: the failure shown here is not missing knowledge. It is the distance between a finding and a mandated, verified fix.
Playbook: from review to closed actions
-
Hold the review within a defined window, and share urgent lessons immediately. Do not wait for recovery to end where a fix is needed now.
-
Build the timeline from logs and records, not memory. Mark what is known, what is inferred and what is unknown.
-
Find the root causes, plural. Ask why the control failed, why detection was late and why response was slow. Separate technical cause from process and ownership cause.
-
Write actions that can be tested. ‘Improve monitoring’ is not an action. ‘Alert on X within Y minutes, tested by Z’ is.
-
Assign one owner with authority, a date and a verification method for each action.
-
Rank actions by risk and tie them to funding. Unfunded actions are wishes.
-
Report to the right level. Material incidents go to the board or its delegated body with the open-action status.
-
Verify closure by test. Re-run the failed scenario, the detection or the recovery step. An action is closed when the test passes, not when the ticket closes.
-
Feed the plans. Update the incident response plan, playbooks, continuity plan and risk register with what you learned, and test them in the next exercise.
Action quality check
| Weak action | Strong action |
|---|---|
| Review access controls | Remove standing admin rights from accounts X and Y by date D; verified by access report |
| Improve patching | Patch all internet-facing systems rated critical within N days of release; measured monthly and reported to the CISO |
| Raise awareness | Test the help desk reset procedure with impersonation calls each quarter; fail rate reported |
| Update the plan | Add the failed decision point to the playbook and exercise it in the next tabletop; result recorded |
Decision
Decision: track open post-incident actions as a single board-visible list with age and owner. Any action past its date without a documented risk acceptance is escalated.
What this evidence does not show
The NAO report describes one national health system in 2017. It does not show that other sectors close actions faster or slower. NIST SP 800-61 Revision 3 describes recommendations, not required timelines. The playbook steps and quality check are Cybrilliant analysis. We did not review the CSRB or other incident reports for closure rates.
A short test
Take your last major incident. List the review actions. Count how many were closed with a test result. If the answer is zero, the review produced a document, not an improvement.
Sources
-
NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
-
NIST Cybersecurity Framework 2.0 (CSWP 29), 26 February 2024. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
-
Central Bank of the UAE, Operational Risk Management Regulation C 1/2026, Rulebook. Accessed 9 October 2026. rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation
-
UK National Audit Office, Investigation: WannaCry cyber attack and the NHS, HC 414, 2017-19. Accessed 9 October 2026. nao.org.uk/wp-content/uploads/2017/10/Investigation-WannaCry-cyber-attack-and-the-NHS.pdf nao.org.uk
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionDetect, Respond & RecoverSpot attacks early and get back to business fast.See how we work →Related service
Post-Incident Improvement
Use this to turn your next post-incident review into owned, dated and verified actions, starting with the five questions above on the last review you ran.