Does your organization create after-action reports following security incidents that document the incident details, response actions taken, recovery procedures, and lessons learned?

After-action reports are critical documents that capture the complete lifecycle of a security incident, from detection through resolution, and identify opportunities for improvement. These reports help organizations learn from incidents, refine response procedures, and prevent similar incidents in the future by documenting what happened, how the team responded, what worked well, and what could be improved. An example of acceptable evidence would be a redacted after-action report from a recent security incident that includes sections for incident description, timeline of events, response actions taken, recovery procedures implemented, root cause analysis, and lessons learned with specific recommendations for process improvements.