A security officer is leading a lessons learned meeting. Which of the following should be components of that meeting? (Select TWO).

A demonstration of the IPS system is a technical training activity unrelated to the retrospective analysis of a specific incident.

Reviewing the vendor selection process is a procurement governance activity that is not a standard component of an incident lessons learned meeting.

Calculating the Annual Loss Expectancy (ALE) is a quantitative risk assessment technique used in risk management planning, not in post-incident lessons learned meetings.

A discussion of the event timeline is essential to a lessons learned meeting because it establishes the chronological sequence of events, helping the team understand how the incident unfolded, where delays occurred, and where the response could be improved.

Assigning follow-up items ensures that the improvements and corrective actions identified during the meeting are formally tracked and assigned to responsible parties, preventing the lessons learned from being forgotten.