Which activity supports ongoing prevention after an incident, as described for CPMAI?

Which activity supports ongoing prevention after an incident, as described for CPMAI?

• A. Increase data retention.
• B. Ignore monitoring after incident.
• C. Updating monitoring controls and risk management as part of prevention.
• D. Removing all logs to save space.

Answer: (C)

Ongoing prevention after an incident comes from a continuous improvement loop: analyze what happened, identify gaps, and update defenses so similar events are less likely in the future. In CPMAI practice, the focus is on feeding lessons from the incident back into the system to strengthen detection and risk controls, keeping prevention aligned with evolving threats. Specifically, updating monitoring controls and risk management means refining how you detect and respond to events (adjusting detection rules, adding relevant data sources, tuning alerting, and tightening access controls) while also re-evaluating and enhancing risk management (updating risk registers, reassessing residual risk, prioritizing remediation, and incorporating new threat intelligence). This combination closes the loop between incident learnings and preventive measures. Increasing data retention doesn’t directly prevent incidents and can raise privacy and cost concerns. Ignoring monitoring after an incident eliminates the opportunity to improve defenses, and removing logs erases valuable evidence and hinders future prevention and learning.

Ongoing prevention after an incident comes from a continuous improvement loop: analyze what happened, identify gaps, and update defenses so similar events are less likely in the future. In CPMAI practice, the focus is on feeding lessons from the incident back into the system to strengthen detection and risk controls, keeping prevention aligned with evolving threats.

Specifically, updating monitoring controls and risk management means refining how you detect and respond to events (adjusting detection rules, adding relevant data sources, tuning alerting, and tightening access controls) while also re-evaluating and enhancing risk management (updating risk registers, reassessing residual risk, prioritizing remediation, and incorporating new threat intelligence). This combination closes the loop between incident learnings and preventive measures.

Increasing data retention doesn’t directly prevent incidents and can raise privacy and cost concerns. Ignoring monitoring after an incident eliminates the opportunity to improve defenses, and removing logs erases valuable evidence and hinders future prevention and learning.