At a minimum, which three people should attend a post-incident debrief? (Select three.)

A post-incident debrief, or lessons learned meeting, is crucial for improving security posture. The minimum essential attendees include: the incident managers and staff who have direct operational knowledge (A); the problem manager focused on identifying the systemic root cause to prevent recurrence (C); and a security architect or CTO who has the authority and technical oversight to approve and implement necessary architectural or service redesigns (D). This combination ensures a comprehensive review covering operational, analytical, and strategic aspects of the incident.

B. Human resources is typically involved only if the incident involves employee misconduct or policy violations, not as a minimum requirement for all technical debriefs.

E. While feedback from affected users is valuable for understanding impact, they are not typically required attendees for the core technical and process-oriented debrief meeting.

F. An MFA administrator is a specialized role. Their involvement would be determined by the problem manager's root-cause analysis, not as a default minimum attendee.

1. National Institute of Standards and Technology (NIST). (2018). Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide. Section 3.4.3 "Lessons Learned," p. 46. This guide recommends that post-incident activities include a "lessons learned" meeting with representatives from all involved parties to discuss improvements.

2. SANS Institute. (2021). Incident Handler's Handbook. Section: "Post-Incident Activities (Lessons Learned)." This framework emphasizes including incident handlers, technical leads, and management with the authority to enact change in post-mortem analysis.