An incident response team determines that the root cause of a breach was a phishing email that delivered a malicious document. After remediation, what specific control should be added to the Preparation phase update to prevent recurrence?

The correct control is email security controls including attachment sandboxing and user phishing awareness training, because the root cause was a phishing email with a malicious attachment; the directly relevant preventive controls are email security (attachment detonation in sandbox, anti-phishing filters) and user training to recognize phishing. Increasing the number of IDS signatures installed on the network sensor is wrong because network IDS signatures detect network-based threats; they would not have prevented a phishing email from being opened. Rebuilding all workstations regardless of whether they were affected is wrong because it is a remediation action, not a preventive control for future phishing attacks. Purchasing a more expensive firewall with higher throughput is wrong because firewall throughput is a performance concern; email-borne attacks are not blocked by higher-throughput firewalls.