Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

Which of the following is an important aspect that should be included in the lessons-learned step after an incident?
A . Identify any improvements or changes in the incident response plan or procedures
B . Determine if an internal mistake was made and who did it so they do not repeat the error
C . Present all legal evidence collected and turn it over to iaw enforcement
D . Discuss the financial impact of the incident to determine if security controls are well spent

View Answer

Answer: A

Explanation:

An important aspect that should be included in the lessons-learned step after an incident is to identify any improvements or changes in the incident response plan or procedures. The lessons-learned step is a process that involves reviewing and evaluating the incident response activities and outcomes, as well as identifying and documenting any strengths, weaknesses, gaps, or best practices. Identifying any improvements or changes in the incident response plan or procedures can help enhance the security posture, readiness, or capability of the organization for future incidents