After an incident,but before returning to its normal duties,the CSIRT must do which of the following?

Question

Quizplus · Accepted Answer

Before returning to normal duties, conducting an after-action review (AAR) is crucial to assess what went wrong during the incident and to identify any areas that need improvement. This will help the CSIRT to better respond to future incidents. While restoring data and services is important, they should be done following the AAR. The incident damage assessment should have been done earlier during the incident response process.

After an Incident,but Before Returning to Its Normal Duties,the CSIRT