AFTER 

• Recovery can be a complex and long-running process and will probably involve more people than in the response phase of an incident.
• Be prepared that things may not return to ‘normal’, but could be restored to a new improved normal.
• Review and update your Business Continuity Plan accordingly.
• Consider any lessons learned following the incident to influence future incident planning.