Recently an information security audit customer of ours lost a backup domain controller and contacted their network vendor to rebuild the machine. The bank thought everything was in order until three months later when they were audited. The audit discovered the old backup domain controller had not been rebuilt to be a backup domain controller again as well as no antivirus software was installed. When the bank contacted their network vendor, the bank was told there were some issues the vendor "meant to get back to". Regardless of errors assigning roles for the domain controller, the vendor still should have installed antivirus and other applications requested by the bank.
The reason why steps were missed? [more] No equipment recovery checklists had been created in the bank's Business Continuity Plan (BCP) so the vendor didn’t have a detailed list of steps to take in order to recover. This can lead to both lost time and missed steps when rebuilding equipment. Ensure equipment recovery lists exist for critical components of your infrastructure.