The tactical phase runs the playbook prepared in advance, organised into initiation, execution and termination: the event is examined to determine the extent of recovery needed and the corresponding plan is initiated on correct assumptions; the playbook, tailored to the event with incident response input, is executed, with restoration in dependency order, security controls strengthened, restored assets validated before return to service, issues documented continuously, and monitoring for known malicious behaviour and the artefacts found during detection and response kept running; recovery ends when data is in a known good state, exploited vulnerabilities are remediated and the adversary is gone, after which the team stands down and findings, metrics and lessons are finalised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.