Question

A financial services firm has just completed the recovery phase following a significant data breach. Systems are restored and confirmed operational, and the incident manager wants to ensure the organization captures maximum value from the event. When is the MOST appropriate time to conduct the formal post-incident review?

Accepted Answer

Shortly after recovery is complete, while details are still fresh but operations have stabilized

Answer

During the containment phase, so observations are captured while the incident is active

Answer

Only after regulators have concluded any external investigation into the breach

Answer

At the next scheduled annual incident response plan review meeting