Question

Following a successful containment and recovery from a ransomware incident, the IR team completes a post-incident review. The final report documents the root cause, timeline, response effectiveness, and several recommended process improvements. The IR lead is deciding how the completed report should be handled going forward. Which action provides the MOST long-term value from this deliverable?

Accepted Answer

Use the documented findings and recommendations to update playbooks, controls, and detection rules, then track the improvements to completion

Answer

Archive the report in a restricted evidence locker and reference it only if litigation arises

Answer

Distribute the full report to all employees company-wide to raise general security awareness

Answer

Submit the report to executive leadership solely to justify additional headcount in the SOC