<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-lessons-learned-processes
description: >-
  Implement blameless post-incident retrospective processes with structured facilitation guides, action item tracking, and continuous improvement loops.
domain: cybersecurity
subdomain: incident-management
tags:
  - lessons-learned
  - retrospective
  - post-incident
  - blameless
  - improvement
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.IM-1", "RS.IM-2"]
  frameworks: ["NIST SP 800-61"]
---

# Implementing Lessons Learned Processes

## Overview

Lessons learned is the most critical phase for long-term security improvement.
Blameless retrospectives focus on systemic failures rather than individual
mistakes, producing actionable improvements that reduce recurrence.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Incident documentation | Facts for review |
| Facilitator (not incident lead) | Neutral moderation |
| All responders available | Complete perspective |
| Action tracking system | Remediation follow-up |

## Retrospective Framework

```
TIMELINE: Hold within 5 business days of closure

MEETING STRUCTURE (90 min S1/S2, 60 min S3/S4):
├── 1. Ground Rules (5 min) — blameless, assume good intentions
├── 2. Timeline Review (15 min) — walk through events
├── 3. What Went Well (10 min) — effective actions, good comms
├── 4. What Needs Improvement (20 min) — gaps, delays, failures
├── 5. Root Cause Discussion (15 min) — systemic factors
├── 6. Action Items (15 min) — owner + due date + priority
└── 7. Close (5 min) — summarize, schedule 30-day follow-up
```

## Facilitation Questions

```
DETECTION: How detected? Could we detect sooner? Missing telemetry?
RESPONSE: Severity correct? Right people engaged? What slowed containment?
COMMUNICATION: Timely updates? Breakdowns? Clear escalation path?
PROCESS: Runbooks cover this? Gaps exposed? Roles clear?
SYSTEMIC: Underlying conditions? Similar past incidents? Prevention?
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Retrospective held within 5 business days
- [ ] Blameless ground rules established
- [ ] Action items have owners and due dates
- [ ] 30-day follow-up scheduled
- [ ] Findings shared with relevant teams
