This lesson develops practical capability in Post-Incident Review, Metrics, Exercises, Lessons, and Improvement within ISO/IEC 27035 Foundation (PECB). Activities reflect a security team coordinating users, technical responders, business owners, legal counsel, communications, and external providers, keeping responsibilities, decisions, evidence, exceptions, and improvement actions connected.
The work contributes to the wider course objective to interpret ISO/IEC 27035 incident management principles, preparation, detection, triage, response, recovery, learning, and improvement.
The instructor traces a realistic case involving a security team coordinating users, technical responders, business owners, legal counsel, communications, and external providers. The demonstration shows how to define scope and criteria, collect evidence, record decisions in incident lessons and capability report, and challenge the condition where exercises operates differently from the approved method.
Complete a controlled exercise for Post-Incident Review, Metrics, Exercises, Lessons, and Improvement. Establish responsibilities and acceptance criteria, examine the case where exercises operates differently from the approved method, reach a supported conclusion, and preserve the result in incident lessons and capability report.
Begin with the earliest point where expected practice and observed evidence diverge. Separate a missing record from an ineffective process, and distinguish role ambiguity from a control or competence failure. Treat “exercises operates differently from the approved method” as a hypothesis until the response is tested against the applicable criteria and intended outcome.
Learners can apply Post-Incident Review, Metrics, Exercises, Lessons, and Improvement, explain the reasoning used, and defend the result through incident lessons and capability report.