A company recently experienced a breach. The security staff determined that the intrusion was due to an out-of-date proprietary software program running on a non-compliant server. The server was imaged and copied onto a hardened VM with the previous connections re-established. Which of the following is the next step in the incident response process?

1. Recovery

2. Eradication

3. Lessons Learned

4. Containment

5. identification