When is the disaster over? All processes should include a section on the criteria needed to declare that the disaster is over. Depending on the nature of the incident and local requirements, this may mean a return to normal operations or the reestablishment of a critical function using alternate methods and technologies. Each BC/DR response plan should clearly define the conditions that indicate the incident is done.

Once operations have returned to normal, a few loose ends will need to be tied up and some closing activities should be performed.

One very important step is to ensure that any money spent during the course of the incident is documented and tracked. These costs should be tracked as part of incident tracking along with all other incident activities. Some of the expenditures may be covered by insurance, and some of them may be billable to a different department from the regular operating expenses. Regardless, all of them are part of the incident and need to be tracked.

The incident is not complete without time to reflect on what has been done. Similar to the after-action review that would be part of security incident response, performing a BC/DR review is critical to evaluating whether the team was properly prepared, the processes were clearly documented, the processes were followed, and nothing needed improvement. These reviews should be performed soon after the event, when memories of what happened are still fresh, and should be facilitated by the lead responder(s). An after-action review can be simple or complex, with a few questions or many. The after-action review should include what went well, what could have been improved, and what action items are needed to improve the plan.

The after-action review should include clear deliverables, deadlines, and responsible parties.

Once the after-action review has been performed, make sure that any action items are complete, such as updating documentation, scheduling additional training, and ensuring that any additional personnel are trained on the relevant procedures.