Affected systems are rebuilt to remove malware, attacker accounts and backdoors; all affected hosts and exploited vulnerabilities are identified and patched, including neighbouring systems; and systems return to production in a controlled way from clean images or backups, with hardening, scanning and monitoring for re-compromise. Arrangements cover continuity of critical operations during prolonged containment, a current asset inventory with categorisation, plans to rebuild to a known good state, long-term containment options, and vendor service levels for recovery.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.