Certified Incident Handler (CIH) Practice Ecam

According to CERT's incident management process, which stage focuses on postmortem review improvements?

1. Preparation

2. Protection

3. Detection

4. Response

The correct answer is: Protection

The correct answer highlights the importance of postmortem reviews in the context of incident management. In CERT's incident management process, the stage that focuses on postmortem review improvements is centered on analyzing incidents after they have occurred. This stage involves assessing the effectiveness of the responses to incidents, identifying lessons learned, and implementing improvements to policies, procedures, or training to better prepare for future incidents. While preparation sets the groundwork by developing plans and training personnel, and response deals with the immediate actions taken during an incident, the emphasis on postmortem reviews is crucial in fostering a culture of continuous improvement. This aspect allows organizations to evolve their practices and enhance their overall resilience against future incidents. By conducting these reviews, organizations can pinpoint gaps in their incident handling process and apply the knowledge gained to reinforce their strategies, ultimately leading to a more robust incident management approach. Thus, identifying and focusing on post-incident reviews is essential for fostering ongoing improvement within any incident management framework.