What is MOST important following a post-incident review to help ensure more effective response to future incidents?

The correct answer is B. Updating the incident response plan. The primary purpose of a post-incident review (lessons learned exercise) is to improve future incident response capability. Updating the incident response plan with findings directly achieves this goal by incorporating new detection techniques, closing process gaps, and…

Submitted by skyler.x· Apr 18, 2026Information Security Incident Management

Question

Options

AReviewing materials from the incident investigation
BUpdating the incident response plan
CArchiving incident logs
DReporting root cause analysis to senior management

How the community answered

(32 responses)

A
9% (3)
B
84% (27)
C
3% (1)
D
3% (1)

Explanation

The primary purpose of a post-incident review (lessons learned exercise) is to improve future incident response capability. Updating the incident response plan with findings directly achieves this goal by incorporating new detection techniques, closing process gaps, and refining roles. Reviewing investigation materials (A) is part of the review itself, not a follow-on action. Archiving logs (C) is good record-keeping but does not improve future response. Reporting to senior management (D) is important for governance but does not directly enhance the plan's effectiveness.

Topics

#Post-incident review#Incident response plan#Lessons learned#Continuous improvement

Community Discussion

No community discussion yet for this question.

Full CISM Practice