The Understand phase includes identifying root cause and documenting lessons that can improve the response plan.

### Why this is right The Understand phase examines the incident's root cause and evaluates what went well and what needs improvement. The organization should create a lessons learned document describing adjustments for future incidents. ### The concept Incident response does not end when immediate technical work stops. Reviewing the process helps the organization understand why an incident occurred and whether its response was effective. A lessons learned document records changes for future response. Documenting the steps used to uncover and resolve the incident can also help teams reuse useful mitigation measures and recover more effectively next time. ### The other options - **False**: This would incorrectly exclude post-incident analysis and planned improvement from the lifecycle. ### Terms - **Lessons learned document**: A record of findings from an incident and adjustments intended to improve future response. ### Remember Understand turns incident experience into specific changes for the next response.