Which part of IR planning involves updating IR policies?

• A. Post incident activity
• B. Preparation
• C. Containment
• D. Eradication

Answer: (A)

Updating IR policies happens during the post-incident activity, the lessons learned phase of the incident response lifecycle. After containment, eradication, and recovery, the team reviews what occurred, what worked well, and what didn’t. This analysis reveals gaps, outdated procedures, or miscommunications that need changes. The output is updated policies, procedures, and runbooks, along with revised contact lists and training materials, so future responses are faster and more effective. Preparation builds and rehearses plans before incidents, while containment and eradication focus on stopping the threat and removing it during an incident; the post-incident activity is specifically about learning from what happened and turning those lessons into policy improvements.