The incident response stage that restores systems to normal operation and checks restored data and systems is called _____.

### Why this is right Recovery restores affected systems and services and verifies that they are safe and functional. The course material includes data-integrity checks and business continuity among recovery concerns. ### The concept Recovery should follow appropriate containment and eradication so that an organization does not reconnect a system while the attacker or malware remains. Teams may restore from backups, bring critical services back incrementally, test them, and coordinate with stakeholders. Restoring a backup alone is not enough: responders need to confirm that data and configurations are trustworthy and that the threat has been removed. ### Terms - **Business continuity**: Maintaining essential organizational functions during disruption. - **Data integrity**: Confidence that data is accurate and has not been improperly changed. ### Remember Recovery means restoring service and validating the restored environment, not simply turning systems back on.