Which of the following is the MOST important criterion for complete closure of a security incident?