According to SANS, when should an incident retrospective be performed?

According to the SANS Institute's widely adopted incident handling methodology, the post-incident activity, which includes the retrospective or "lessons learned" meeting, should be conducted in a timely manner. The recommended timeframe is within two weeks of the incident's conclusion. This schedule ensures that the details are still fresh in the minds of the incident response team members, which is crucial for accurately identifying both successes and failures in the response process. Holding the meeting promptly maximizes the value of the review and allows for the swift implementation of improvements to security controls, policies, and procedures.

A. Waiting for law enforcement is impractical as their investigations can be lengthy and are not directly tied to the organization's internal process improvement goals.
B. A six-month delay is far too long; critical details will be forgotten by the team, and the opportunity for timely improvements will be lost.
D. "Immediately" after eradication is premature, as the full recovery and validation phases must be completed to assess the total impact and effectiveness of the response.

1. Kral, P. (2012). Incident Handler's Handbook. SANS Institute InfoSec Reading Room. Page 11, Section "Lessons Learned". "The lessons learned meeting should be held within two weeks of the end of the incident."

2. SANS Institute. (2021). Incident Response Process & Procedures. SANS Security Policy Templates. The template for "Post-Incident Activity" emphasizes the need for a timely meeting to ensure details are not forgotten, aligning with the two-week recommendation.

3. Scarfone, K., & Grance, T. (2012). Computer Security Incident Handling Guide. NIST Special Publication 800-61 Rev. 2. Section 3.4.1, "Holding a 'Lessons Learned' Meeting". While a NIST document, its principles are foundational to the SANS methodology and it states, "Holding a lessons learned meeting promptly (e.g., within two weeks of the end of the incident) is a good practice." This corroborates the industry best practice taught by SANS.