What happens after incident response?

After incident response, the work carries on for several weeks. You need to finish remediation (rebuilding and hardening what was hit), write the final report, complete the notifications provided for by the applicable texts, run a lessons-learned review and keep monitoring more closely. This phase decides whether the organisation comes out of the incident stronger or merely relieved.

This article is part of our series on how incident response unfolds. For the full picture, see How does incident response work?.

The end of the emergency is not the end of the incident

The emergency response usually ends once the attacker has been evicted and critical operations are running again. At that point, though, parts of the IT estate are often still in a degraded state, temporary fixes are in place and some questions remain open.

France’s national cybersecurity agency, ANSSI, treats remediation as a project in its own right, planned and steered separately from incident handling. NIST makes a similar point in revision 3 of SP 800-61, published in April 2025: incident response feeds continuous improvement across cybersecurity risk management. It does not end when the ticket is closed.

Five workstreams after an incident

1. Finish remediation

Emergency measures (disabled accounts, blocked traffic, isolated machines) must give way to lasting fixes: rebuilding compromised servers, patching, redesigning admin rights and hardening the directory. It is also the time to check that restored backups are clean. See Does incident response include data recovery?.

2. Write the final report

The incident report sets out the timeline, entry point, affected systems and data, actions taken and recommendations. It serves management, the insurer, the authorities and, where relevant, the courts. See What goes into an incident report?.

3. Complete notifications

Regulatory deadlines do not stop when the emergency does:

Text	Duty after the emergency phase
NIS2, Article 23	Final report no later than one month after the incident notification, or a progress report if the incident is still ongoing
GDPR, Article 33	Supplement the notification to the supervisory authority as information becomes available; document the breach
GDPR, Article 34	Inform affected individuals where the risk to their rights is high

NIS2 deadlines apply through each country’s national law, and transposition timing varies across the EU. See Is incident response mandatory?.

4. Run a lessons-learned review

The review brings together technical teams, management, the MSP and the incident response provider. It is not about blame. It looks at what let the attack in, what slowed detection and what worked or failed during the crisis. Useful questions:

• How long between the first sign of the attack and its detection?
• Were the right people reached, and in time?
• Were backups, procedures and emergency contacts up to date?
• Which decisions lacked the information needed to make them quickly?

5. Watch closely

In the following weeks, the attacker may try to return through an overlooked access path. Monitoring is therefore stepped up on privileged accounts, remote connections and rebuilt machines. See How do you prevent a second attack?.

Turning lessons into an action plan

A useful review ends with a short, prioritised action plan, with an owner and a deadline for each item. Typical items: MFA everywhere, network segmentation, a review of service accounts, regular restore tests and an updated incident response plan.

The plan needs tracking over time, for example in steering meetings between the client and its MSP. Monthly reports from a managed SOC help check that measures are working: fewer critical alerts, vulnerabilities fixed, unused accounts removed.

The role of the MSP and the SOC

The MSP often carries most of the technical remediation, since it knows and runs the environment. The SOC and CERT provide analysis, reporting and closer monitoring. At Cyna, the CERT, a member of InterCERT France, works alongside the managed SOC teams, which helps link incident response and monitoring at the most fragile moment. The terms (scope, timeframes) are set out in the contract agreed with your partner MSP. For the split of roles, see Managed SOC and MSP: who does what?.

Talk to an expert

Coming out of an incident and want to structure what comes next? If you work with a Cyna partner MSP, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Who pays for remediation after a cyberattack?

It depends on the incident response contract, the managed services contract and any cyber insurance policy. It pays to know what each one covers before a crisis. See What does incident response cover?.

Should we tell customers and partners?

If customers' personal data is affected and the risk to them is high, GDPR Article 34 provides for informing the people concerned. Beyond that, factual communication with exposed partners limits spread and protects trust.

Should senior management attend the lessons-learned review?

Yes. Some lessons call for management decisions on budget, priorities and accepted risk. NIS2 Article 20 also makes management responsible for approving cybersecurity risk measures.

How long should collected evidence be kept?

At least as long as any legal proceedings or insurance claim may last. Store it securely with a record of how it was collected, and ask your lawyer about retention.