A CSIRT has completed restoration procedures related to a breach of sensitive data and is creating documentation used to improve future response activities and coordination among team members. Which of the following information would be MOST beneficial to include in lessons learned documentation? (Select TWO)

- A summary of approved policy changes based on the outcome of the incident

- Details of any communication challenges that hampered initial response times

- Details of man-hours and related costs associated with the breach, including lost revenue

- Details regarding system restoration activities completed during the response activity

- Suggestions for potential areas of focus during quarterly training activities

- Suggestions of tools that would provide improved monitoring and auditing of system access