Following a successful phishing incident at the clerk’s office, which action best belongs in the lessons-learned phase?
Select an answer to reveal the explanation.
Short Explanation
Lessons learned is the after-action huddle where the clerk’s office turns bruises into better drills. Updating the phishing playbook and how staff report suspicious mail closes the loop. Wiping everything blindly or deleting the evidence trail wastes the hard-won insight.
Full Explanation
Lessons learned captures post-incident improvements to procedures, controls, and training. Updating the phishing playbook and reporting steps feeds operational gains back into preparation for the next event. Mass reimaging without analysis, discarding investigative alerts, or paying adversaries does not constitute a structured lessons-learned activity and may worsen readiness or evidence integrity.