The paper trail is the deliverable in a compromise recovery

Recovery is judged on what the organisation can show, not only on what it rebuilt. Three decisions and three tests carry most of the weight.