Which ISO 27035-1 phase focuses on learning from incidents to improve future responses?

• A. Lessons learned
• B. Prepare
• C. Identify and report
• D. Assess

Answer: (A)

Focusing on learning from incidents to improve future responses is the phase that closes the incident management cycle by capturing what was learned and turning it into actionable improvements. In ISO 27035-1 this stage involves reviewing the incident handling, identifying what worked well and what didn’t, documenting insights, and updating policies, procedures, training, and controls accordingly. This creates a feedback loop that strengthens readiness for future incidents.

Other phases are about preparation, detection and reporting, and assessment during an incident. They set up, detect, and evaluate incidents, but the dedicated learning phase specifically aims to translate experience into improved capabilities for the future.