Following the eradication of malware from a compromised customer-facing application, the incident response team has rebuilt the affected servers from known-good images. The business unit is pressuring the information security manager to return the application to production immediately to minimize revenue loss. Before authorizing the transition of the system back to normal operations, what should the information security manager ensure has been established FIRST?