Question
Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?
- A. Develop a call tree to inform impacted users
- B. Schedule a review with all teams to discuss what occurred Correct
- C. Create an executive summary to update company leadership
- D. Review regulatory compliance with public relations for official notification
Explanation
A lessons-learned review with all involved teams is the post-incident activity designed to improve future incident response: it examines what happened, what worked and what should change in procedures and tools. A call tree and regulatory notification are communication tasks during the incident, and an executive summary informs leadership but does not by itself improve the process.
