SANS Incident Handler's Handbook and PICERL Methodology
Phase 5: Recovery – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology R-1: System owners decide the date and time to restore operations, on the response team's advice

What does R-1 require?

Affected systems are returned to production carefully so they do not cause another incident; the decision on when to restore operations rests with the system owners or operators, based on the response team's advice.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 5: Recovery – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls