Which component of the NIST SP800-61 r2 incident handling strategy reviews data?

Preparation focuses on building incident handling capability, acquiring tools, and establishing policies before incidents occur, not reviewing data from completed incidents.

Detection and analysis is the active phase of identifying indicators of compromise and understanding an ongoing incident in real time, not a retrospective data review.

Containment, eradication, and recovery involves actively limiting damage, removing threats, and restoring systems during an incident - it is an operational response phase, not a data review phase.

NIST SP800-61 r2 defines post-incident activity as the phase that includes a formal lessons-learned meeting and retrospective analysis of all data collected during the incident. This phase systematically examines what occurred, how effectively the team responded, and what procedural or technical changes should be implemented - making it the component explicitly responsible for reviewing incident data after resolution.