Describe the activities that make up the post-incident activity phase of the incident response life cycle, including identification of lessons learned and evidence retention.
Examples: cyber incident planning and response (CIPR) action checklist
