Which step in the incident response determines what changes must be put in place to prevent future problems?
1) Recovery
2) Investigation and closure
3) Lessons learned
4) Analysis