Which of the following is a PRIMARY goal of conducting a post-incident review?

The correct answer is B. To promote continuous process improvement. The primary goal of a post-incident review (also called a lessons-learned review or after-action review) is to promote continuous process improvement by identifying what worked, what did not, and what can be done better in future incidents. The review examines detection…

Submitted by valeria.br· Apr 18, 2026Information Security Incident Management

Question

Options

ATo ensure internal procedures are established and followed
BTo promote continuous process improvement
CTo provide the proper documentation for internal audits
DTo support disciplinary actions taken following the security incident

How the community answered

(46 responses)

A
2% (1)
B
91% (42)
C
2% (1)
D
4% (2)

Explanation

The primary goal of a post-incident review (also called a lessons-learned review or after-action review) is to promote continuous process improvement by identifying what worked, what did not, and what can be done better in future incidents. The review examines detection, response, communication, and recovery processes to strengthen the organization's overall security posture. Ensuring procedures are followed (A) is a compliance objective and a byproduct, not the primary driver. Providing documentation for audits (C) may be a useful output but is secondary to operational learning. Supporting disciplinary actions (D) is an HR function and is not a security management objective of the review - treating it as such would discourage honest reporting and reduce the effectiveness of future reviews.

Topics

#Post-incident review#Incident management#Continuous improvement

Community Discussion

No community discussion yet for this question.

Full CISM Practice