Restore normal operations - Re-enable any revoked access (with corrected permissions) - Increase monitoring for 30 days post-incident