SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-incident-containment

What is the immediate goal of incident containment?

Containment aims to prevent the incident from expanding.

Start playing free

  1. Limit further spread ✔
  2. Erase every record
  3. Resume normal service immediately

Why: Responders may isolate a host, quarantine malware, or block a malicious route to limit additional damage. The underlying cause can then be eradicated more safely.

Huh, didn't know that: Containment may be an emergency workaround, a temporary control, or a permanent measure.

The dad joke
Containment drew a small box and told the incident to stay put.
Like this card?
Play the game

References

Answer: Limit further spread. Responders may isolate a host, quarantine malware, or block a malicious route to limit additional damage. The underlying cause can then be eradicated more safely.

  1. NIST SP 800-61 Rev. 3 nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r3.pdf
    Containment refers to preventing the expansion of an incident.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich activities belong in an incident-handling capability?Security & PrivacyWhat does incident eradication remove after containment?Security & PrivacyWhich three goals form the CIA triad?

That's stuff everyone should know.