Which component involves evaluating the incident after resolution to identify improvements and lessons learned?

• A. Post-incident review
• B. Detection
• C. Analysis
• D. Containment

Answer: (A)

Post-incident review is the stage where, after you’ve resolved the incident and restored services, you step back to analyze what happened and what you can improve. The goal is to capture lessons learned, assess how the detection, containment, and recovery actions performed, and update runbooks, playbooks, and preventive controls to prevent recurrence. This turns experience into better preparation for future incidents.

Detecting an incident happens during the event — recognizing and alerting to it. Analysis focuses on understanding root causes and impact during the incident. Containment aims to limit damage while the incident is active. Post-incident review specifically targets learning and process improvements after the fact.