Which component focuses on documenting lessons learned and remediation steps after an incident has been contained and recovered?

Which component focuses on documenting lessons learned and remediation steps after an incident has been contained and recovered?

• A. Recovery
• B. Containment
• C. Documentation of lessons learned and remediation steps
• D. Escalation

Answer: (C)

After an incident has been contained and recovery is underway, the focus shifts to learning from what happened and planning improvements. This post-incident activity, often called a lessons-learned review or post-mortem, documents what went well, what didn’t, and the remediation steps needed to close gaps and prevent recurrence. It ensures the organization updates playbooks, defenses, and processes based on real experience, strengthening future responses. Recovery is about restoring services to normal and validating that operations are back to baseline. Containment aims to limit the incident’s spread or impact while it’s active. Escalation handles raising the issue to the appropriate level of support or authority. None of these center on capturing lessons and actionable remediation steps like the post-incident review does.

After an incident has been contained and recovery is underway, the focus shifts to learning from what happened and planning improvements. This post-incident activity, often called a lessons-learned review or post-mortem, documents what went well, what didn’t, and the remediation steps needed to close gaps and prevent recurrence. It ensures the organization updates playbooks, defenses, and processes based on real experience, strengthening future responses.

Recovery is about restoring services to normal and validating that operations are back to baseline. Containment aims to limit the incident’s spread or impact while it’s active. Escalation handles raising the issue to the appropriate level of support or authority. None of these center on capturing lessons and actionable remediation steps like the post-incident review does.