A security analyst needs to produce a document that details how a security incident occurred, the steps that were taken for recovery, and how future incidents can be avoided.
During which of the following stages of the response process will this activity take place?
A . Recovery
B . Identification
C . Lessons learned
D . Preparation
Answer: C