ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Post-incident guidance from NIST SP 800-61 and ISO/IEC 27035 emphasizes conducting a lessons-learned analysis, producing a detailed report, and updating policies, procedures, and playbooks so that weaknesses uncovered during the incident are addressed before future events occur. Capturing the incident timeline, root cause, and control gaps-and sharing the findings with stakeholders-facilitates organizational learning and strengthens security posture. Simply rotating keys or changing service configurations may be appropriate containment or remediation tasks, but without documenting findings and updating processes, the organization misses the primary objective of the post-incident phase. Purging evidence or disabling logging violates both forensic and compliance requirements, while restoring compromised privileges without analysis can re-introduce risk.