Post-Knowledge-Assessment (CR – Incident Response: Post Incident Activity)

Who is the best facilitator for a post-incident lessons-learned session?

During what phase of the incident response process would an organization get to go through the report and train relevant personnel on how to avoid similar incident in future?

What are some of the questions should the incident responder answer during the Post Incident Activity phase?

Updating incident response policies and procedures is an important part of the lessons learned process.

Which of the following factors should be put into consideration during the evidence retention policy creation