CISM: Certified Information Security ManagerDemo

Question

Which of the following is MOST important to review after a security incident?

A Incident response procedures
B Response tools and techniques
C Incident response plan
D Lessons learned

Explanation

A lessons-learned review captures the incident’s causes, response effectiveness, gaps, and improvement actions. Its findings drive necessary updates to incident-response plans, procedures, tools, and techniques.

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ246

Community Discussion