After containing a data compromise that disrupted operations across multiple departments, a global consulting enterprise...

The EC-Council Incident Handler (ECIH) curriculum defines Post-Incident Activity as the phase focused on lessons learned, root cause analysis, and process improvement. Conducting a formal retrospective with cross-functional stakeholders to reconstruct timelines, evaluate decision-making, and identify coordination gaps aligns directly with a structured postmortem analysis.

ECIH emphasizes that post-incident reviews should promote a no-blame culture to encourage transparency and honest feedback. The objective is continuous improvement of incident response playbooks, communication protocols, escalation procedures, and overall organizational readiness. Root cause analysis (RCA) is a key component, ensuring that both technical and procedural weaknesses are identified and corrected.

Option B (reclassification) is an administrative adjustment, not a comprehensive review. Option C (vendor notification) relates to external communication. Option D (checklist updates) may result from the review but does not describe the primary activity being executed.

Therefore, the organization is performing a formal postmortem to analyze root causes and operational effectiveness.