In an incident response plan, which phase focuses on analyzing the incident after recovery to improve future responses?

• A. Preparation
• B. Containment
• C. Recovery
• D. Lessons Learned

Answer: (D)

The main idea tested is how we learn from an incident after things have been brought back to normal. This phase is about looking back at what happened, analyzing what went well and what didn’t, and turning those insights into concrete improvements for the future. By conducting a post-incident review, you identify root causes, gaps in detection, delays in response, and communication or coordination issues. Then you update the incident response plans, runbooks, training, and controls so future incidents can be detected sooner, contained faster, and recovered more smoothly. Other phases focus on getting ready beforehand, stopping the incident from spreading, or restoring services, but the reflective work that feeds back into better preparedness and response is the lessons-learned phase.