What it means
Incident root-cause analysis identifies the technical, process, organizational, and environmental conditions that allowed an incident to begin, spread, or remain undetected.
Why it matters
Removing one malicious artifact does not prevent recurrence when the underlying access path, control failure, or decision weakness remains.
Practical focus
- Use evidence from the full incident timeline
- Distinguish triggering event from enabling conditions
- Examine control design and operation
- Assign corrective actions to accountable owners
Common mistakes
- Stopping at human error
- Selecting one cause for a complex event
- Speculating without evidence
- Closing analysis without verifying corrective action
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: