The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.

### Why this is right The scenario lists a simulated compliance audit, continuous monitoring, staff training, and proactive risk management as post-incident actions. These activities fit the recovery and compliance review phase. ### The concept Recovery is more than returning to ordinary operations. A post-incident review can identify documentation needs and compliance gaps, while monitoring helps the organization detect future suspicious activity. Training helps staff understand expectations, and lessons from the incident can inform policy and control improvements. These actions support continuing readiness; completing a mock audit or providing training does not, by itself, prove compliance. ### Terms - **Mock audit**: A practice review used to identify documentation needs and possible gaps before an actual audit. - **Continuous monitoring**: Ongoing observation of systems or activity to help identify security concerns. ### Remember Use recovery review to turn incident findings into monitored, assigned improvements.