The correct answer is D because implementing lessons learned from post-incident reviews directly improves the organization's incident management capability. Post-incident reviews identify what worked, what failed, where delays occurred, whether escalation was effective, whether communication was timely, and whether containment and recovery procedures were adequate. The value comes from converting those findings into corrective actions, updated procedures, improved training, better tools, revised playbooks, and stronger controls. Performing a business impact analysis is useful for continuity planning and recovery priorities, but it does not directly enhance incident management unless linked to improvements. Benchmarking against best practices can identify improvement opportunities, but it does not improve capability unless changes are implemented. Aligning the incident response plan with the business plan is important for business relevance, but continuous improvement is best achieved through actual lessons learned. CISM incident management emphasizes post-incident review, root cause analysis, corrective action, and continuous improvement.
Reference: CISM Information Security Incident Management; lessons learned, post-incident review, corrective action, and incident response improvement principles.