Name who decides that recovery is complete and business may resume, and the decision factors, including confirmation that the cause has been addressed so the same attack does not recur; reinitialise damaged devices or rebuild systems and confirm normal operation; when restoring from backups, remember they may already be tampered with or infected (clearing and settlement institutions ask participants to resend unconfirmed instructions); confirm normal operation and connections before reconnecting to other systems; confirm with system owners that critical operations were recovered in the right order and are running normally; and after recovery analyse the causes of the incident and of its spread, evaluate the response, and revise the incident response and contingency plans and the whole cybersecurity framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.