Which of the following is NOT a recommended practice for the post-incident lessons learned phase?

• A. Escalate the incident response chain without documenting lessons learned
• B. Document root cause, remediation actions, update security controls, and share findings with stakeholders
• C. Conduct a formal post-incident review and update incident response procedures
• D. Communicate lessons learned to relevant stakeholders and integrate improvements

Answer: (A)