Remediation

Short definition

Actions intended to regain control of a compromised system and restore sufficiently secure operation. They include containing the intrusion, removing the attacker, eradicating persistence mechanisms and rebuilding. Backups and restored assets need verification. Restoring the service and assessing information already copied outside the organisation are separate tasks.