Managing a security incident does not end once the incident itself has been contained. The post-incident phase raises critical questions around organisational recovery, operational continuity, impact assessment and the return to standard operations. The presentation will focus on the practical aspects of the post-incident phase, the decisions that influence what happens next, and lessons that can help organisations respond more effectively to similar events in the future.