Root cause analysis (RCA) is a structured method for determining the fundamental cause of an incident or problem. Common techniques include the 5-Why method, Ishikawa diagrams, and fault-tree analysis. The aim is to look beyond the obvious symptoms and find the actual trigger. In an ISMS, root cause analysis is part of the incident-response process and continual improvement (Clause 10.1). You document the findings in the incident report and derive corrective actions that prevent recurrence.