Does your incident response system allow authorized responders to manually select and execute eradication actions during security incidents?

Hands-on control during eradication is what reviewers want to verify, namely whether authorized responders can manually select and execute actions to remove threats during an incident. Manual eradication capabilities are crucial when automated responses are insufficient or when incidents require human judgment to determine the most appropriate remediation approach without causing operational disruptions.

Evidence could include screenshots of your incident response platform showing manual eradication options, documented procedures that outline the process for manual intervention, or access control lists showing which team members have permissions to execute eradication actions.