Managing Catastrophic Loss of Sensitive Data

Chapter 9. Closure

Solutions in this chapter:

• Lessons Learned/Postmortem Meeting

• Incident Impact and Costs

• Root Cause Analysis

• Corrective Action Plan

• Internal and External Follow-Up

• Closure Report

Summary

Introduction

An incident can be closed upon the completion of the investigation, the issuance of external notifications if warranted, and the implementation of all suitable security remediation measures. This phase provides closure for the incident by taking action against its cause and learning from it to improve current processes and procedures. The successful close of a data security incident involves several steps:

1. Lessons Learned and Postmortem

2. Cost ...