During the clean-up of an APT incident, various IT systems are reinstalled and networks are also temporarily isolated. As a consequence, IT systems will inevitably fail and services may only be available to a limited extent (or not at all). If the clean-up takes a long time, it can reduce the respective organisation's productivity. This in turn may cause significant economic losses that could even threaten the organisation's existence. This is particularly the case if documentation for the recovery process is insufficient or unavailable.