Which components are typically included in post-incident activities within a playbook?

Which components are typically included in post-incident activities within a playbook?

• A. Post-incident lessons learned and communication, among others.
• B. Budget approval and vendor negotiation.
• C. Marketing outreach after incident.
• D. Physical security checks unrelated to incident.

Answer: (A)

Post-incident activities in a playbook focus on turning what happened into actionable improvements: capturing lessons learned, documenting what occurred, and communicating findings to the right stakeholders. This phase ensures the team understands what worked, what didn’t, and what needs to change, while also outlining follow-up actions, remediation steps, and updates to other playbooks or defenses. That combination—lessons learned and communication, along with the accompanying actions—is why this option is the best fit for post-incident work. Budget approval and vendor negotiation are typically part of planning or procurement processes rather than the immediate post-incident learning cycle. Marketing outreach after an incident isn’t a standard post-incident playbook task, since the focus is on internal improvement and containment, not external messaging. Physical security checks unrelated to the incident fall outside the post-incident IT and cybersecurity response workflow and would be addressed separately.

Post-incident activities in a playbook focus on turning what happened into actionable improvements: capturing lessons learned, documenting what occurred, and communicating findings to the right stakeholders. This phase ensures the team understands what worked, what didn’t, and what needs to change, while also outlining follow-up actions, remediation steps, and updates to other playbooks or defenses. That combination—lessons learned and communication, along with the accompanying actions—is why this option is the best fit for post-incident work.

Budget approval and vendor negotiation are typically part of planning or procurement processes rather than the immediate post-incident learning cycle. Marketing outreach after an incident isn’t a standard post-incident playbook task, since the focus is on internal improvement and containment, not external messaging. Physical security checks unrelated to the incident fall outside the post-incident IT and cybersecurity response workflow and would be addressed separately.