Question

A security team has just completed the recovery phase after a ransomware incident. Systems have been restored from backups, business operations have resumed normally, and monitoring confirms no residual malicious activity. The CISO wants to ensure the organization improves its defenses and documentation before institutional memory fades. Which activity should the incident response team prioritize NEXT, and when should it be conducted?

Accepted Answer

Conduct a lessons-learned meeting within a short, defined window after recovery, producing a report with root cause and recommended improvements

Answer

Immediately re-image all endpoints again as a precaution before documenting anything, then defer any review until the next quarterly audit

Answer

Begin the containment phase again to double-check that lateral movement was fully stopped before closing the incident

Answer

Wait at least six months so metrics on recurrence can be gathered before holding any post-incident discussion