Question

A ransomware incident at a mid-sized firm has been fully contained, eradicated, and systems have been restored from clean backups with normal operations verified. The incident response manager wants to derive the greatest long-term value from the event. What should be the NEXT action to strengthen the organization's future response capability?

Accepted Answer

Conduct a lessons-learned review with all involved stakeholders to identify root causes and process improvements, then update the response plan

Answer

Immediately reimage all remaining endpoints as a precaution against dormant malware

Answer

Notify law enforcement and file an insurance claim to recover incurred costs

Answer

Archive the incident tickets and close the case since recovery is complete