What is the role of incident post-mortems and lessons learned in Annex B?

• A. Document incidents without implementing improvements.
• B. Assign blame to individuals.
• C. Analyze incidents to identify root causes, improve controls, and update policies and training.
• D. Ignore lessons learned.

Answer: (C)

The main idea is to learn from incidents by examining what happened and turning that knowledge into real improvements. The best choice emphasizes analyzing incidents to identify root causes, improving controls to prevent recurrence, and updating policies and training so the organization behaves differently in the future. This focus on systemic factors and actionable changes is what makes post-mortems effective in Annex B, because it closes the loop and strengthens defenses over time.

Documenting an incident without any follow-up actions doesn’t close the loop on learning. Blaming individuals shifts the focus away from processes and controls that may fail, which reduces the chances of meaningful improvement. Ignoring lessons leaves the organization vulnerable to repeating the same mistakes.