SANS Incident Handler's Handbook and PICERL Methodology
Phase 5: Recovery – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology R-2: Test and verify restored systems, monitor them for a set period with chosen tools, and compare against baselines

What does R-2 require?

Before and after return to production the team tests, monitors and validates the systems to confirm they are clean, functional and not being reinfected or compromised by the same method, deciding how to test, how long to monitor for abnormal behaviour, which tools to use, and whether earlier benchmarks exist as a baseline for comparison.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 5: Recovery – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls