Glossary: Incident Response and Resilience

containment

Also written: contain

The phase that stops an incident from spreading, by blocking, quarantining or unplugging a machine. It comes before eradication so that cleaned machines aren't reinfected.