Which activity helps readdress security tasks identified in past incident reports?

An After Action Report documents the timeline, impact, and lessons learned from a specific incident; it identifies tasks but does not itself re-examine or track progress on tasks from previous reports.

Root cause analysis determines the underlying technical or process failure that enabled an incident; it is performed during or immediately after an incident, not as an ongoing review of past report tasks.

Follow-up review meetings provide a structured forum to revisit the action items, remediations, and security gaps documented in past incident reports, assigning ownership and verifying completion. This activity closes the loop on previously identified vulnerabilities and process failures, which is a core component of the post-incident activity phase defined in NIST SP 800-61. Without these meetings, tasks identified in reports often go unaddressed.

Containment and eradication are active incident response phases focused on stopping an ongoing threat and removing it, not reviewing historical reports or managing outstanding remediation tasks.