Question

Following a confirmed business email compromise incident, your SecOps team completed a blameless post-incident review. The review produced eight corrective actions, ranging from enabling phishing-resistant MFA to updating a SOAR playbook that lacked an approval gate. Two weeks later, leadership asks the SOC manager to demonstrate that the incident's lessons are actually reducing organizational risk. Which practice BEST ensures the post-incident review translates into measurable risk reduction?

Accepted Answer

Assign each corrective action a single accountable owner and due date, and track completion to closure in a tracking system with periodic status review

Answer

Archive the post-incident report in the case management system so it can be referenced if a similar incident recurs

Answer

Immediately re-run the SOAR containment playbook against the affected mailboxes to confirm the threat is eradicated

Answer

Increase the severity threshold of the phishing detection rule so fewer low-priority alerts reach the queue