5.4 Explain cleanup and restoration activities.

Cleanup

Remove persistence mechanisms

Delete every task, service, key, shell and account created.

Revert configuration changes

Restore any settings changed during testing.

Remove tester-created credentials

Delete accounts, keys and tokens created for testing.

Remove tools

Delete uploaded binaries, scripts and payloads.

Spin down infrastructure

Shut down C2 servers, phishing domains and cloud resources used for the test.

Preserve artifacts

Keep evidence needed for the report, stored securely.

Secure data destruction

Securely delete client data per the agreement once no longer needed.