At a hospital, after the incident is over, leadership and the people who responded meet to change the handling plan. Which phase are those stakeholders serving in that meeting?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a film session after the game: you review what happened and adjust the next plan. You’re in post-incident analysis when hospital leaders and responders meet after the incident to revise the handling plan. The preparation meeting, live containment call, and vendor sales demo don’t match that purpose.
Full Explanation
Post-incident analysis is where the people who handled an event and the leaders who own the plan review what happened and revise the plan. The hospital meeting takes place after the incident is over, and its purpose is to change how incidents will be handled, so it is post-incident analysis, where responders and leaders revise the handling plan. The preparation phase, as if this were the first planning meeting years earlier, is about getting ready before an incident; it does not fit a meeting held after the incident to update the plan. A live containment call that is still isolating hosts on the clinical network is part of an ongoing response, whereas the scenario says the incident is over and stakeholders are meeting to revise the plan. A vendor sales demo, as if the meeting existed only to pitch a replacement tool, is a commercial presentation, not a review by responders and leaders to improve handling. Exam caveat: NIST SP 800-61 Rev. 3 maps incident-handling phases onto CSF 2.0 Functions, but exams may still use the name post-incident analysis for this lessons meeting. Practical check: file the meeting notes as a plan update with owners and due dates, then confirm that the actions change the written procedure rather than reopening host isolation.