After a security incident, management is meeting with involved employees to document the incident and its aftermath. Which of the following BEST describes this phase of the incident response process?

The 'Lessons Learned' phase (also called Post-Incident Activity) occurs after an incident is resolved and involves meeting with all stakeholders to document what happened, review the response effectiveness, and identify improvements. This phase produces a formal report capturing the incident timeline, actions taken, and recommendations to prevent recurrence.

Recovery is the phase focused on restoring affected systems and services back to normal operation, not documenting the incident aftermath with employees.

Identification (also called Detection/Analysis) is the phase where the team determines whether an event constitutes an actual security incident, which occurs early in the response process before remediation.

Preparation is the phase that occurs before any incident, involving establishing policies, tools, and training so the team is ready to respond effectively when an incident does occur.