Remove any tools, scripts, or payloads deployed on client systems - Reset any passwords changed during testing - Delete any test accounts created - Remove any persistence mechanisms (unless explicitly asked to leave them for blue team training) - Document all cleanup activities