Incident response and recovery are run from separate playbooks, so the handoff from containment to restoration is clumsy and slow. Recovery starts late because the two halves aren't joined up.
"When we contain an incident, does recovery flow straight on, or do we lose time switching playbooks?"
Handoff delay
Integrated IR-recovery flow
To first outcomes