After you have finished recovering from an incident and systems are back to normal functioning, you need to document the entire incident and its recovery process. You also need to determine the steps to prevent a similar incident from occurring. Which phase of the Incident Response are you in?
a) Preparation
b) Identification
c) Containment
d) Lessons Learned