A previous-year update should report only successes and omit incidents or areas needing improvement.

### Why this is right The update is intended to describe progress and areas for improvement, and to mention incidents or breaches at a high level. Omitting problems would give an incomplete basis for the next strategy. ### The concept Reviewing the previous period creates continuity between strategy cycles. It lets leaders see whether initiatives were delivered, whether they had the intended effect, and whether new risks or incidents changed priorities. The update need not contain every incident detail, but it should not conceal relevant outcomes. ### The other options - **The statement is false**: an update that includes only successes would fail to identify unresolved gaps and lessons from incidents. ### Terms - **Incident**: an event that may compromise information, systems, or services. ### Remember A useful review records progress and learning, not just achievements.