Which of the following post-incident activities serves as the most comprehensive tool for an organization to evaluate its response to a security incident and to identify areas for improvement?
Facilitating a 'lessons learned' meeting
Updating documentation with incident details
Conducting a forensic analysis
Performing root cause analysis