A company recently experienced a significant data breach. During the post$-$incident investigation, the incident response team performed a root cause analysis to determine the factors contributing to the breach.

Which of the following statements is true regarding root cause analysis?

It is only useful for identifying the technical factors that led to an incident, not the human or procedural

factors.

It is a quick and simple process completed in a single meeting.

It involves working backward from the immediate cause of an incident to determine the ultimate cause.

It is unnecessary if an organization has a robust incident response plan in place.