What role does documentation play in accountability after security incidents?

• A. It is optional and not necessary.
• B. It only serves internal audits.
• C. Provides a factual record for review, training, and legal compliance.
• D. It should be avoided to protect staff.

Answer: (C)

Documentation provides a factual, verifiable record of what happened after a security incident—what occurred, when, who did what, what evidence was collected, and what decisions were made. This record lets supervisors, investigators, and trainers trace actions, verify adherence to procedures, and determine whether proper steps were followed. It also fuels learning by highlighting gaps and guiding improvements in procedures and training to prevent recurrence. Legally and regulatorily, thorough documentation demonstrates due diligence, preserves evidence, and supports audits or investigations, helping establish accountability for staff and the organization. Because of these functions, documentation is essential for transparency, compliance, and continuous improvement.

Options that treat documentation as optional, limited to internal audits, or something to avoid fail to recognize its broader role in accountability and safety.