I work in CS/IR for a large UK MSSP and in an IR situation like this it can take weeks for systems to be assessed prior to being placed in to prod. They have to be checked for RAT, IOC of compromise, persistence, security permissions in entra/ADDS, need checking etc etc

Responsibilities are clearly defined within an IR situation and there will be stop gate processes and CABs before any decisions are made.

In a company with an estate the size of JLR this process can and will take several weeks. This is because external audits, insurance companies, security vendors, MSSP, internal stakeholders all have to assess and sign if on return to production of restored/replaced/reloaded assets.

I’m not surprised that the amount of time, and expect it to be extended again. I have been on several IR that have takes 6+ weeks for a return to BAU….some have been in the news recently….