A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame for
whose fault it was that the incident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner?

A.
During the Identification Phase

B.
During the Lessons Learned phase

C.
During the Containment Phase

D.
During the Preparation Phase