Glossary: Security Operations and Incident Response

Containment

Also written: contain

The fast, temporary step that stops an incident spreading or causing more damage before it is removed. It weighs ongoing damage against business impact and lost evidence, and it comes before eradication.