An emergency configuration change is made during containment. What should happen after stabilization?

1. Leave the change undocumented because it helped
2. Document, review, and reconcile the change through the emergency-change process
3. Automatically reverse it before checking current risk
4. Delete the pre-incident configuration permanently