Which component involves evaluating the incident, documenting lessons learned, and improving the plan?

• A. Detection
• B. Analysis
• C. Post-incident review
• D. Recovery

Answer: (C)

The main idea here is capturing lessons learned and driving improvements after an incident through a post-incident review. Once the incident is resolved, the team evaluates what happened, assesses how the response went, and documents the lessons learned. This phase identifies gaps, tests what worked well, and defines concrete corrective actions with owners and deadlines. The goal is to update the incident response plan, playbooks, and preventive controls so future incidents are handled more effectively. By contrast, detection focuses on recognizing incidents, analysis determines impact and scope, and recovery concentrates on restoring services; they address immediate response rather than long-term improvement.