Given a IR Team deployed supporting a designated MP in a completed Cyber Incident Recovery.
A mission out briefing should be conducted to inform MP of the completed cyber incident recovery mission. During this briefing, the following items should be included in briefing:
The IR Team communicates the after-action review report and lessons clearly and concisely to MP. The MP reviews the briefing and asks questions for clarification purposes.
The listing in the standards is not exhaustive.
NIST Cyber Security Framework
NIST SP 800-61: Computer Security Incident Handling Guide