Certified Information Security Manager (CISM) — Question 700
Which of the following is the MOST important output from a post-incident review?
Answer options
- A. Documentation of lessons learned
- B. Repository of digital forensic artifacts
- C. Revised business impact analysis (BIA)
- D. Compilation of incident-related costs
Correct answer: A
Explanation
The most important output from a post-incident review is the documentation of lessons learned, as it helps organizations improve their incident response and prevent future occurrences. While the other options provide valuable information, they do not contribute as directly to enhancing processes and strategies as the lessons learned do.