A zero-day after-action review should rebuild the timeline, measure how fast you answered "are we affected," test each decision against what you knew then, check communication, and end with a short list of dated fixes with owners. Keep it blameless and hold it within two weeks while memory is fresh.
Set the ground rules
Blameless does not mean consequence-free. It means you ask what in the system allowed the outcome, not who to punish. People share more when they are not defending themselves.
Invite the incident owner, technical lead, system owners, communications and legal. Use the response log as the source of truth, not recollection.
Questions by theme
Timeline
- When did the advisory become public, and when did we first see it?
- When did we confirm affected, not affected and unknown for every system?
- When was the first stopgap applied, and when was the fix verified?
Inventory
- Which systems were unknown for the longest, and why?
- Which sources of truth disagreed?
Decisions
- What did we know when we chose patch or mitigate?
- Were approvals quick, or did they stall?
Compromise check
- Did we define the exposure window?
- What could we not check because logs were missing?
Communication
- Did executives, staff and customers get what they needed on time?
- Did any message turn out to be wrong?
Compliance
- Did we ask whether any notification clock applied, and when?
Measures worth recording
| Measure | Why it helps |
|---|---|
| Time from public advisory to first inventory answer | Shows inventory quality |
| Time from answer to stopgap on exposed systems | Shows change speed |
| Count of systems left unknown after 24 hours | Shows coverage gaps |
| Number of rollbacks | Shows test quality |
Do not use these to rank teams. Use them to see whether the next event is faster.
Turn answers into work
End the meeting with at most five actions. Each needs an owner, a date and a way to check it is done. Typical outputs include fixing inventory gaps, pre-approving a fast change path, adding log retention, or updating the runbook. See a one-page runbook template.
NIST SP 800-61 Rev. 3 places lessons learned within the broader improvement of cybersecurity risk management, which is what this meeting feeds.
A short agenda
Spend 10 minutes on the timeline, 20 on inventory and decisions, 15 on communication and compliance, and 15 on actions. Close by confirming owners and dates in writing. Send the notes to everyone who took part within two days.
Quick check
When should we hold the review?
Within about two weeks of closing the incident, while details are still clear.
How many actions should come out of it?
A handful, each with an owner and date. A long list rarely gets done.
Sources
Last reviewed: 19 October 2026.
