An incident management team leader sends out a notification that the organization has successfully recovered from a cyberattack. Which of the following should be done NEXT?

Securing and preserving digital evidence for analysis is typically performed during the containment and eradication phases of an incident, not after the notification of full recovery.

Gathering feedback on business impact is an important part of the incident review, but the formal mechanism for consolidating this and other insights for improvement is the lessons learned meeting.

A 'lessons learned' meeting, conducted after an incident has been contained and recovered from, allows the incident management team and stakeholders to review the entire incident response process. This post-incident analysis identifies what worked well, what did not, and what improvements are needed for future incidents, fostering continuous enhancement of the incident response plan and team readiness.

Preparing an executive summary for senior management is an output of the incident response process, which should incorporate insights from the lessons learned, meaning the meeting should precede the summary's finalization.