Which phase involves documenting the incident, assessing impact, and identifying improvements to prevent recurrence?

Which phase involves documenting the incident, assessing impact, and identifying improvements to prevent recurrence?

• A. Preparation
• B. Detection and Analysis
• C. Post-Incident Review
• D. Eradication

Answer: (C)

Post-incident review focuses on learning from what happened and preventing it from recurring. After containment, eradication, and restoration, the team documents the incident in detail, assesses the impact on systems and operations, and identifies concrete improvements to processes, controls, and training. This phase aims to turn experience into better preparation—updating playbooks, adjusting detection and response steps, and closing gaps so similar incidents are less likely or less damaging in the future. Preparation is about getting ready before an incident occurs—planning, training, and setting up tools. Detection and Analysis centers on recognizing an incident and understanding its scope as it unfolds. Eradication is about removing the threat and restoring clean systems.

Post-incident review focuses on learning from what happened and preventing it from recurring. After containment, eradication, and restoration, the team documents the incident in detail, assesses the impact on systems and operations, and identifies concrete improvements to processes, controls, and training. This phase aims to turn experience into better preparation—updating playbooks, adjusting detection and response steps, and closing gaps so similar incidents are less likely or less damaging in the future.

Preparation is about getting ready before an incident occurs—planning, training, and setting up tools. Detection and Analysis centers on recognizing an incident and understanding its scope as it unfolds. Eradication is about removing the threat and restoring clean systems.