# What is a lessons-learned review after an incident?

It is a meeting, held within a few weeks of the incident, in which everyone involved goes through what happened and what to change. Use the incident log to rebuild the timeline, then ask four questions: what went well, what went badly, what did we not know or not have, and what will we change, with an owner and a date for each change. Keep it blameless: the aim is to fix systems and procedures, not to find someone to punish, otherwise people hide mistakes the next time. Typical outcomes are a closed remote-access path, MFA where it was missing, a backup that is now offline, a phone list that works, a log that is kept longer. Feed the results into your plan and your next tabletop exercise. NetSenX alerts and the audit log give the review a factual timeline for the network side.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-is-a-lessons-learned-review-after-an-incident

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What do we do with a security alert at night when nobody is on call?](https://netsenx.com/en/faq/a-security-alert-at-night-and-nobody-on-call)
- [Could we have seen a weekend ransomware attack coming?](https://netsenx.com/en/faq/could-we-have-seen-a-weekend-ransomware-attack-coming)
- [How much time passes between first access and encryption?](https://netsenx.com/en/faq/how-much-time-between-first-access-and-encryption)
- [How can ransomware spread through a USB stick or external drive?](https://netsenx.com/en/faq/how-can-ransomware-spread-through-a-usb-device)
- [What evidence should we keep for the insurer, the police and the regulator?](https://netsenx.com/en/faq/what-evidence-to-keep-for-insurer-police-and-regulator)