CISM · Question #735
Which of the following is the MOST important objective of post-incident review activities?
The correct answer is C. Continuous improvement. Continuous improvement (C) is the primary objective of post-incident reviews because the entire purpose of reviewing what went wrong - and what went right - is to learn from the incident and strengthen processes, controls, and responses to prevent recurrence or reduce future…
Question
Which of the following is the MOST important objective of post-incident review activities?
Options
- AIncident triage
- BIncident documentation
- CContinuous improvement
- DEvidence collection
How the community answered
(29 responses)- A3% (1)
- C93% (27)
- D3% (1)
Explanation
Continuous improvement (C) is the primary objective of post-incident reviews because the entire purpose of reviewing what went wrong - and what went right - is to learn from the incident and strengthen processes, controls, and responses to prevent recurrence or reduce future impact.
- A (Incident triage) happens during the incident response phase, not after it - it's about prioritizing and categorizing the incident in real time.
- B (Incident documentation) is an important supporting activity of post-incident review, but it's a means to an end; the documentation serves the improvement goal, not the other way around.
- D (Evidence collection) is primarily a forensic/legal activity that occurs during or shortly after the incident, and while it may inform the review, it is not the review's main purpose.
Memory tip: Think of post-incident review as a "lessons learned" meeting - the word post means it's already over, so triage and evidence collection are done. The only reason you're still talking about it is to get better, making continuous improvement the clear winner.
Topics
Community Discussion
No community discussion yet for this question.