Glossary · OT cybersecurity
Post-incident review
Also known as: Post-mortem, Lessons learned review, After-action review
German: Nachbetrachtung eines Vorfalls
A post-incident review is the structured analysis after an incident has been contained and operation restored: it reconstructs what happened, why the controls did or didn’t work, what it cost, and which changes to systems, procedures, documentation and responsibilities follow — with owners and deadlines.
- OT security
In one sentence
A post-incident review reconstructs an incident and decides what changes — systems, procedures, documentation — with owners and deadlines.
Example
After an agent sent wrong maintenance intervals to a customer portal, the review finds a missing approval gate for published content, adds it and updates the agent’s instructions.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: Review and update the documentationStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Restoring operations after an AI agent incidentWhat can be undone after an AI agent crossed its boundary, what can’t — and when may the agent and the systems it touched run again?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
How it applies
- Blameless, not toothless: The review asks why the system allowed the action, not who to blame — and still ends with concrete changes and owners.
- For AI agents: Cover the boundary (was it defined?), detection (how long until someone noticed?), containment (which rung worked?), restoration (what couldn't be undone?) and reporting (which duties applied?).
- Documentation is an output: Instructions, runbooks, the agent's scope and the information for users are updated; in regulated products the technical documentation may have to follow.
- Improvement loop: NIST SP 800-61 Rev. 3 places lessons learned in the improvement of all CSF 2.0 functions, not only incident response.