Which phase of the Incident Response Plan includes reviewing the incident to improve future response?

• A. Preparation
• B. Lessons Learned
• C. Eradication
• D. Recovery

Answer: (B)

Post-incident review and continuous improvement happen during the lessons learned phase. After handling an incident, the team analyzes what occurred, what actions were effective, and where gaps or delays happened. This reflection leads to concrete improvements: updating the incident response plan and runbooks, addressing root causes, enhancing monitoring and controls, and adjusting training and communication processes. The goal is to turn experience into better preparedness for future incidents.

Preparation focuses on building capability before an incident, eradication is about removing the threat from systems, and recovery centers on restoring services and returning to normal operations. None of these primarily address learning from the incident to strengthen future responses the way lessons learned does.