They’ll Be Back. You Need To Be Ready When They Try.
If you've been compromised, the attacker probably knows your system better than you do. An Incident Response means you need to look at everything. If there's a hole or a gap, chances are high that the attacker noticed it and will try to exploit the vulnerability at a later point.
Don’t let them back in.