Which of the following should be updated after a lessons-learned review?

Question

Options

• ADisaster recovery plan
• BBusiness continuity plan
• CTabletop exercise
• DIncident response plan

• A
  3% (1)
• B
  5% (2)
• C
  3% (1)
• D
  90% (36)

Explanation

Lessons-Learned Review and Incident Response

After a security incident is resolved, a lessons-learned review (also called a post-incident review) is conducted to analyze what happened, what worked, and what needs improvement. The Incident Response Plan (IRP) is the primary document updated as a result, since it directly governs how incidents are detected, contained, eradicated, and recovered from - and any gaps or inefficiencies discovered should be incorporated to improve future responses.

Why the distractors are wrong:

• A (Disaster Recovery Plan): The DRP focuses on restoring IT systems and infrastructure after a disaster, not on the step-by-step process of handling security incidents - it is not the primary output of a lessons-learned review.
• B (Business Continuity Plan): The BCP addresses keeping business operations running during disruptions; while it may occasionally be updated, it is not the standard target of an incident response lessons-learned review.
• C (Tabletop Exercise): A tabletop exercise is a simulation activity used to test plans, not a document that gets updated as a result of a lessons-learned review.

Memory Tip: Think of the cycle: Incident → Response → Learn → Update the IRP. Lessons learned feed directly back into the plan that governs incident response - keeping the loop closed for continuous improvement.

No community discussion yet for this question.