5.13-Conduct Outbriefing
Conduct Outbriefing of Mission Partner (MP) Task¶
Conditions¶
Given a IR Team deployed supporting a designated MP in a completed Cyber Incident Recovery.
Standards¶
A mission out briefing should be conducted to inform MP of the completed cyber incident recovery mission. During this briefing, the following items should be included in briefing:
- After Action Review (containing follow up report and lessons learned)
- Lessons Learned
- Question and Answer Session
End State¶
The IR Team communicates the after-action review report and lessons clearly and concisely to MP. The MP reviews the briefing and asks questions for clarification purposes.
Notes¶
The listing in the standards is not exhaustive.
Manual Steps¶
Running Script¶
Dependencies¶
Other available tools¶
References¶
NIST Cyber Security Framework
NIST SP 800-61: Computer Security Incident Handling Guide