An after-action report (AAR) is the most comprehensive document associated with a closed incident because it consolidates the incident itself, the response activities performed, recovery actions, outcomes, deficiencies, and lessons identified during the event. NIST Cybersecurity Framework guidance specifically calls for preparing an after-action report that documents the incident, response and recovery activities, and lessons learned.

A lessons-learned document focuses primarily on what worked, what failed, and what should be improved. Those observations are important, but they represent only one component of a complete post-incident record. Root cause analysis has a narrower technical purpose: determining the fundamental condition that permitted the incident to occur or progress. A situation report is generally produced while an incident is ongoing to communicate current status, impact, actions, and outstanding issues.

An AAR is broader because it can incorporate the timeline, technical findings, containment and eradication actions, recovery results, stakeholder performance, root cause, lessons learned, and assigned corrective actions. NIST exercise guidance likewise treats lessons learned as information that becomes part of an after-action report.

Study Guide Reference: Reporting and Communication → Post-Incident Reporting → After-Action Reports → Lessons Learned → Root Cause Analysis → Corrective Actions.