The first objective is to establish control: activate the response team, record decisions, preserve volatile evidence and avoid uncoordinated changes.
Containment should be proportionate. Destroying evidence or shutting down critical services without analysis can make the situation worse.
Key points
- ✓ Activate the response structure
- ✓ Preserve evidence
- ✓ Document every action
- ✓ Coordinate containment and communications