What it asks for. Use the knowledge gained from information security incidents to strengthen and improve the organisation's controls.
In practice. After significant incidents, and periodically across smaller ones, the organisation runs a blameless review to establish root causes, contributing factors and what worked or failed in the response. Actions are assigned owners and dates, tracked to closure, and fed into risk assessments, awareness content, detection rules and playbooks. Trend analysis across incident types, volumes and costs informs management review. Auditors expect post-incident reports, an action log with closure evidence and examples where an incident led to a concrete control change.
Common gaps. Lessons learned meetings are often held but their actions are never tracked, so the same weaknesses recur. Minor incidents and near misses are seldom analysed together, which hides patterns that only show up in aggregate.