A retailer's security team has identified a compromised point-of-sale server, isolated it from the network, and confirmed all malware has been removed and the vulnerability patched. They now need to reconnect the server, restore its services, and closely monitor it to ensure the system operates normally without signs of reinfection. Which incident response phase does this activity represent?