(Choose 1 answer)
After an incident, but before returning to its normal duties, the CSIRT must do which of the following?
A. Create the incident damage assessment
B. Conduct an after-action review
C. Restore data from backups
D. Restore services and processes in use
E. None of the mentioned
E12
