Incident Response
IR-07Hold the lessons-learned review within five business days and track the fixes
How Leela would run itEvent-driven · each High or Critical incident, within 5 business days of containment; findings shared within 30 days of closure
From the policy libraryThe requirement
Every High or Critical incident, and any Moderate incident the Compliance Officer selects, receives a post-incident review. Within five business days of containment the response team holds a facilitated lessons-learned meeting covering what happened and why, what went well and what did not, and the control changes needed. Each improvement is assigned an owner and a completion date and tracked to closure; high-impact items go on the compliance roadmap, and the findings are shared with the sponsor bank in the closure report.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Schedule the meeting from the containment date, record the root cause and the agreed improvements with owners and dates, track each to closure, and include the findings in the bank’s closure report.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Lessons-learned recordMeeting date, attendees, root cause, improvements with owner and due date
- 02Remediation trackerEach item with its status and closure date
Evidence
Lessons-learned record
Incident Response §8
2
of 2 records
The work and the records come from this obligation in the policy library.