ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A comprehensive post-incident report should capture how the incident unfolded, the actions taken, and who performed them so that management, auditors, or regulators can verify that proper procedures were followed and evidence was protected. A time-stamped chronology that maps each investigative and response step to the individual or team responsible establishes a clear chain of custody and demonstrates due diligence, directly supporting accountability and evidence-integrity objectives.

• The detailed AWS cost breakdown is useful for budgeting but does not address accountability or evidence handling.
• A high-level business-impact summary is important for executives but does not prove that evidence was properly managed.
• An improvement plan helps drive future remediation; however, without a documented timeline of actions and custodians, it does little to establish how evidence was controlled during the incident.