If an incident reaches a point where damage has occurred then a recovery response is required. This recovery effort is led by the SoC but in most cases carried out by specialist areas. This may include Legal responses and management of the organisations reputation via media management, customer comms etc.