What is the purpose of an incident post-mortem, and what should it include?

• A. To punish responsible individuals; include disciplinary actions.
• B. To certify compliance; include audit report.
• C. To learn from incidents and improve defenses; should include timeline, root cause, impact, and corrective actions.
• D. To finalize the incident budget; include cost estimates.

Answer: (C)