Exam CISM topic 1 question 345 discussion

Impact analysis conducted before and not after incident

The keyword here is corrective actions which means making improvements which will happen as part of lessons learned or post incident review/assessment, so the best answer is D

Option D

D - The whole point of post-mortem analysis/lessons learned is to identify improvements

Of course its B

D. Conducting a postmortem assessment

onducting a postmortem assessment (option D) is the BEST way for an information security manager to determine corrective actions after a major information security incident. It allows for a thorough evaluation of the incident, identifies underlying causes, and provides guidance for strengthening the security program and preventing future incidents.