I am currently making amendments to an IR process and the topic of incident closure has come up. The organisation follows NIST and therefore their IR process has four phases:
- Detection & Analysis
- Containment, Eradication & Recovery
- Post-Incident activity
My proposal is that an incident can be deemed resolved once a post-mortem meeting or meetings have been conducted and concluded. Any recommendations or activities identified as part of this phase are considered outside the scope of responding to an incident. When considering the phases above, anything that comes out of the Post-Incident activity feeds directly into the Preparation phase.
My thinking here is that in some cases, a post-incident recommendation may be significant and require project management. There seems to be an appetite for an incident to be considered unresolved as long as post-incident recommendations have not yet been implemented. My reluctance here is that this will impact SOC performance metrics.
Interested to get thoughts on this and how the topic of incident closure is handled within other organisations.