Post-incident activity

- Lessons learned workshop agenda - Metrics (MTTD, MTTR, scope, cost) - Action item tracking - Threat intelligence integration - Runbook updates Provide: RACI matrix, communication templates (initial, update, closure), evidence collection checklist, legal hold procedure, and regulator notification decision tree. Include tabletop exercise scenarios. Output as a complete IR runbook.