The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

Following the completion of a root cause analysis, the incident response process enters the "Post-Incident Activity" phase, as defined by the NIST framework. The primary goals of this phase are to learn from the incident and improve the organization's overall security posture. Key actions include creating a final report and briefing management on the findings, impact, and lessons learned (A). A critical outcome of this phase is to implement changes that prevent recurrence of the incident. This is achieved by updating security policies, procedures, and controls based on the identified root cause (B). These two actions are foundational to the post-incident process.

C. Training staff for future incidents: While training is a valid post-incident activity, it typically follows after policies and procedures have been updated and approved by management.
D. Investigating responsible staff: This is an administrative or human resources function that may run parallel to the incident response process but is not a core phase of it.
E. Drafting a recovery plan for the incident: A recovery plan is drafted and executed during the "Containment, Eradication, & Recovery" phase, which occurs before the post-incident activity phase.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication (SP) 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 3.4

"Post-Incident Activity

" details the final phase of the incident response lifecycle. It emphasizes the importance of a "lessons learned" meeting

which involves creating a follow-up report for management (supports option A) and using the collected information to improve security controls

policies

and procedures (supports option B). (Page 36-37).

2. Carnegie Mellon University

Software Engineering Institute. (2017). Defining Incident Management Processes.

The document outlines the incident management lifecycle

including a "Post-Incident Analysis" step. It states

"The main goals of this step are to determine the root cause of the incident

document any lessons learned

and develop strategies to prevent a similar incident from occurring in the future." This directly supports updating policies (B) and implies reporting findings to stakeholders like management (A). (Section: "Post-Incident Analysis").

3. University of California

Berkeley

Security Policy. (2021). Incident Response Plan.

Section 6.0

"Post-Incident

" describes the activities following an incident's resolution. It specifies the creation of a "Post-Incident Report" which is shared with management and stakeholders (supports option A) and includes "Recommendations for policy

procedure

or resource changes" (supports option B).