What Is Post Incident

The Post Incident Review (PIR) process is an evaluation of the incident management response and recovery effort for major, critical and high priority incidents. … The output of the meeting is a report of potential findings detailing how the incident could have been handled better.

What is post incident activity?

In the post incident activity phase, often referred to as a postmortem (latin for after death), we attempt to determine specifically what happened, why it happened, and what we can do to keep it from happening again. This is not just a technical review as policies or infrastructure may need to be changed.

How do you do a post incident review?

1. Incident detection. …
2. Incident response and resolution. …
3. Incident analysis. …
4. Build a detailed incident timeline.
5. Maintain a record of communication history throughout the incident timeline.
6. Analyze all of the data from the above bullet points and draw some conclusions.