Exam CISM topic 1 question 1026 discussion

evidence should be preserved as early as possible

C - After an incident, it’s crucial to analyze what went well and what could be improved. A lessons-learned meeting helps identify areas for enhancement, update incident response procedures, and enhance overall resilience. A is important too, BUT it’s typically done during the incident response process, not immediately after recovery.

Option A should be done before sending email that recovery is complete. How can you recover without finding root cause and identifying entry point of malware and blocking it from happening again.

Conducting a meeting to capture lessons learned as the next step after a notification is sent out stating that the organization has successfully recovered from a cyberattack. This meeting will allow the incident management team to gather insights and feedback on the incident response process, identify any areas for improvement, and share best practices for future incidents. It is important to capture these lessons learned while the incident is still fresh in everyone's minds to ensure that the organization can better prepare and respond to any future cyberattacks. Once the lessons learned have been captured, the team can proceed with securing and preserving digital evidence for analysis, gathering feedback on business impact, and preparing an executive summary for senior management.

The evidence is going to be needed for lessons learned and RCA

C. Conduct a meeting to capture lessons learned.