Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

Question

Options

• ADevelop a call tree to inform impacted users
• BSchedule a review with all teams to discuss what occurred
• CCreate an executive summary to update company leadership
• DReview regulatory compliance with public relations for official notification

• A
  4% (1)
• B
  92% (22)
• C
  4% (1)

Explanation

One of the best actions to take after the conclusion of a security incident to improve incident response in the future is to schedule a review with all teams to discuss what occurred, what went well, what went wrong, and what can be improved. This review is also known as a lessons learned session or an after-action report. The purpose of this review is to identify the root causes of the incident, evaluate the effectiveness of the incident response process, document any gaps or weaknesses in the security controls, and recommend corrective actions or preventive measures for future incidents.

No community discussion yet for this question.