Playbooks are consistently followed during incidents and kept current with lessons learned
Updating playbooks with lessons learned after each activation keeps the preparation work in this control current instead of a one-time document.
Following the playbooks during real incidents is one operational piece of this control's response behavior, which also spans containment, escalation and notification beyond playbook execution alone.
Updating playbooks with lessons learned after each activation covers one type of improvement this control asks for, not the full range of incident knowledge A.5.27 expects to feed back into controls.