CISM Incident Management Practice Question

What is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To update the incident response plan and procedures

Lessons learned aims to improve future response by identifying what worked and what didn't.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To determine if legal action is needed
Why it's wrong here
Legal decisions are made by counsel, not in lessons learned meetings.
✗
To calculate the financial impact of the incident
Why it's wrong here
Financial impact is assessed separately; lessons learned is about improvement.
✗
To assign disciplinary actions
Why it's wrong here
The focus is on process improvement, not punishment.
✓
To update the incident response plan and procedures
Why this is correct
The meeting generates recommendations to enhance the IR program.

Go deeper