Incident response · The response plan · Element
The containment
What is done first to stop the harm.
The part
What it is
Containment comes before investigation. Understanding can follow; the harm cannot be allowed to continue while it does.
Containment actions should be pre-authorised, since asking for permission to stop harm is a delay with no benefit.
The smallest level
The attributes it carries
Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.
The other elements in the response plan
The roles
Who does what during an incident.
LearnThe notifications
Who must be told, within how long, and what starts the clock.
Learn