According to SANS, when should an incident retrospective be performed?

According to SANS, an incident retrospective should be performed no later than two weeks from the end of the incident. This allows the team to review the response, identify lessons learned, and improve future incident handling while the details are still fresh.