Control: ism-1213; Revision: 2; Updated: Dec-21; Applicability: ALL; Essential Eight: N/A ​

Following intrusion remediation activities, full network traffic is captured for at least seven days and analysed to determine whether the adversary has been successfully removed from the system.