How do you incorporate feedback and lessons learned from incidents into your severity level system?

How do you incorporate feedback and lessons learned from incidents into your severity level system? If you work in incident response, you know how important it is to have a clear and consistent way of categorizing and prioritizing incidents based on their impact and urgency. But how do you make sure that your severity level system is aligned with your business objectives, customer expectations, and operational realities? In this article, we will explore how you can use feedback and lessons learned from incidents to improve your severity level system and make it more effective and adaptable.

Find expert answers in this collaborative article

Selected by the community from 2 contributions. Learn more

1 Why feedback and lessons learned matter

Feedback and lessons learned are essential sources of information and insight for any incident response team. They can help you identify what went well and what went wrong during an incident, what root causes and contributing factors led to the incident, and what actions and recommendations can prevent or mitigate similar incidents in the future. By collecting and analyzing feedback and lessons learned from various stakeholders, such as customers, users, business owners, technical teams, and external partners, you can gain a comprehensive and balanced perspective of the incident and its consequences.

Add your perspective

Leighton Johnson, CISSP

CyberSecurity Consultant
Report contribution
Feedback provides areas to learn from and ensure the incident gets handled this time and the next Lessons learned are needed to properly understand the particulars of the response

Like

2 How to collect feedback and lessons learned

When collecting feedback and lessons learned from incidents, there are various methods and tools you can use, depending on your needs and preferences. Post-incident surveys are a popular choice to gather feedback on the incident severity, impact, communication, resolution, and satisfaction. Additionally, post-incident reviews can be conducted with the incident response team and other relevant stakeholders to discuss the incident timeline, actions, outcomes, challenges, and opportunities. Furthermore, post-incident reports can be created to summarize the key information and insights from the incident. These reports should include details about the incident, its impact, root cause, resolution, feedback, lessons learned, and improvement plans. They should also follow a standard format or template for consistency and clarity when sharing them with the appropriate audiences.

Add your perspective

Leighton Johnson, CISSP

CyberSecurity Consultant
Report contribution
Interviews are my choice for capturing the actions taken by the responders, the support staff and the initial handlers. I work through the reports with the interviewees to add depth and color to the written record

Like

3 How to analyze feedback and lessons learned

Once you have collected feedback and lessons learned from incidents, you need to analyze them to extract meaningful and actionable insights. Different techniques and frameworks can be used for this analysis, such as quantitative analysis which measures and compares numerical data from feedback and lessons learned, using charts, graphs, tables, or dashboards. Qualitative analysis can be used to interpret the textual or verbal data from feedback and lessons learned, using methods like coding, categorizing, or thematic analysis to identify common themes. Additionally, root cause analysis can be used to identify the underlying causes of incidents, using tools such as the 5 Whys, fishbone diagrams, or fault tree analysis.

Add your perspective

4 How to incorporate feedback and lessons learned into your severity level system

After analyzing feedback and lessons learned from incidents, you can use them to improve your severity level system and make it more relevant and responsive to your business and customer needs. To do this, you can update your severity level criteria, align it with your business objectives and customer expectations, and test and validate it. This can include adjusting the definitions, thresholds, or indicators of each severity level to reflect the actual or expected impact and urgency of incidents on your business and customers. Involving business owners and customers in defining or validating the system can ensure that it meets their requirements. Additionally, testing and validating the system by applying it to past or hypothetical incidents, as well as soliciting feedback from the incident response team and other stakeholders, can help you make adjustments or improvements as necessary.

Add your perspective

5 How to monitor and review your severity level system

Finally, it’s important to monitor and review your severity level system regularly to keep it current and suitable for your changing environment and needs. You can track and measure your severity level performance by collecting and analyzing data on the number, distribution, and trends of incidents by severity level, as well as monitor the quality and timeliness of your incident response activities and outcomes. Additionally, periodic audits or reviews should be conducted to assess its compliance, consistency, and suitability. Furthermore, you can seek continuous feedback and learning from incidents by maintaining an open dialogue with customers, users, business owners, technical teams, and external partners. This will help foster a culture of learning and improvement in your incident response team.

Add your perspective

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

How do you incorporate feedback and lessons learned from incidents into your severity level system?

1

2

3

4

5

6

1 Why feedback and lessons learned matter

2 How to collect feedback and lessons learned

3 How to analyze feedback and lessons learned

4 How to incorporate feedback and lessons learned into your severity level system

5 How to monitor and review your severity level system

6 Here’s what else to consider

Incident Response

Rate this article

Thanks for your feedback

More articles on Incident Response

More relevant reading