Which of the following BEST enables an organization to improve its incident response plan?

The correct answer is D. Performing lessons learned exercises. Conducting lessons learned exercises after each incident helps an organization identify weaknesses, improve response strategies, and refine procedures in its incident response plan. These reviews provide actionable insights into what worked well and what needs improvement, enabli

Submitted by zhang_li· Apr 18, 2026Information Security Incident Management

Question

Options

ATesting the incident response plan monthly
BFocusing on high-risk events for improvements
CExpanding the size of the incident management team
DPerforming lessons learned exercises

How the community answered

(64 responses)

A
11% (7)
B
3% (2)
C
5% (3)
D
81% (52)

Explanation

Conducting lessons learned exercises after each incident helps an organization identify weaknesses, improve response strategies, and refine procedures in its incident response plan. These reviews provide actionable insights into what worked well and what needs improvement, enabling continuous enhancement of the incident response process. Regular testing and focusing on high-risk events are useful, but without analyzing past incidents, improvements may not be effectively implemented.

Topics

#Incident Response Plan#Lessons Learned#Continuous Improvement#Incident Management

Community Discussion

No community discussion yet for this question.

Full CISM Practice