During a security incident, the response team has successfully contained a compromised web server by isolating it from the network. Application services are being restored to a standby environment to maintain business operations. Before declaring the incident resolved, the incident manager insists on one additional step during the eradication phase. Which action is MOST important to complete before recovery is finalized?