Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Event And Incident Response, Continuity Of Operations
  4. >Event And Incident Response, Continuity Of Operations - Objective 3
  5. >C2M2-RESPONSE-3H
C2M2-RESPONSE-3HActive

Cybersecurity incident lessons-learned activities are performed and corrective actions are taken, including updates to the incident response plan

Statement

Cybersecurity incident lessons-learned activities are performed and corrective actions are taken, including updates to the incident response plan

Location

Domain
Event and Incident Response, Continuity of Operations
Objective
Event and Incident Response, Continuity of Operations - Objective 3

Practice Details

Identifier
C2M2-RESPONSE-3H
Domain
Event and Incident Response, Continuity of Operations
Objective
Objective 3
Maturity Level
MIL-2

Help Text

Define and implement activities for collecting lessons-learned input from incident response participants after significant incidents, such as hotwash sessions or submission of comments on a team wiki. Participants could provide feedback about how well the incident response plan was followed, any shortcomings in needed resources, and, overall, which incident response actions worked well and which didn’t. Make updates to the incident response plan based on lessons learned where appropriate. Note that the term lessons learned is used in the common, general sense and not as related to definitions used in any specific regulation or guideline.

Related Practices · Progression: This practice is part of multiple practice progressions. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in the first progression include: RESPONSE-3a, RESPONSE-3d, RESPONSE-3f, RESPONSE-3g, RESPONSE-3h, RESPONSE-3i. · The practices in the second progression include: RESPONSE-3b, RESPONSE-3e, RESPONSE-3h, RESPONSE-3i, RESPONSE-3l.

AESCSF
AESCSF-RESPONSE-3hequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Event and Incident Response, Continuity of Operations - Objective 3
Event and Incident Response, Continuity of Operations - Objective 312 controls
C2M2-RESPONSE-3ACybersecurity incident response personnel are identified, and roles are assigned, at least in an ad hoc mannerC2M2-RESPONSE-3BResponses to cybersecurity incidents are executed, at least in an ad hoc manner, to limit impact to the function and restore normal operationsC2M2-RESPONSE-3CReporting of incidents is performed (for example, internal reporting, ICS-CERT, relevant ISACs), at least in an ad hoc mannerC2M2-RESPONSE-3DCybersecurity incident response plans that address all phases of the incident lifecycle are established and maintainedC2M2-RESPONSE-3ECybersecurity incident response is executed according to defined plans and proceduresC2M2-RESPONSE-3FCybersecurity incident response plans include a communications plan for internal and external stakeholdersC2M2-RESPONSE-3GCybersecurity incident response plan exercises are conducted periodically and according to defined triggers, such as system changes and external eventsC2M2-RESPONSE-3HCybersecurity incident lessons-learned activities are performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3ICybersecurity incident root-cause analysis is performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3JCybersecurity incident responses are coordinated with vendors, law enforcement, and other external entities as appropriate, including support for evidence collection and preservationC2M2-RESPONSE-3KCybersecurity incident response personnel participate in joint cybersecurity exercises with other organizationsC2M2-RESPONSE-3LCybersecurity incident responses leverage and trigger predefined states of operation (SITUATION-3g)