Following a significant data breach, an organization completed its post-incident review and documented several lessons learned, including gaps in detection tooling and unclear escalation thresholds. Six months later, a similar incident occurs and the response team struggles with the same escalation confusion. What did the information security manager MOST likely fail to do?