Definition
Lessons Learned is the process of analysing completed Incidents to identify causes, evaluate the effectiveness of actions taken and implement improvements that reduce the Risk of similar events recurring.
Human Explanation
After an Incident, the organisation examines what happened, what worked well and what needs to improve.
Why it Matters
Every Incident can provide knowledge that strengthens organisational resilience and improves security processes.
Conceptual Boundary
Lessons Learned is not about assigning blame. Its purpose is to improve the organisation, its procedures and its response.
Practical Perspective
The value lies in implementing improvements identified by the analysis, not merely producing a post-Incident report.