← Incident Response Foundations: From First Signal to Durable Recovery
1. Prepare and Triage with Purpose
Prepare the Response Before the Incident Triage a Signal into a Defensible Next Action
2. Scope, Contain, and Recover
Scope the Incident and Preserve Useful Evidence Containment, Eradication, and Safe Recovery
3. Communicate, Learn, and Strengthen
Incident Communication and Coordination Turn an Incident into Durable Improvement
High-Impact Scenarios and Response Leadership
Respond to Identity Compromise and Cloud Control Incidents Lead Ransomware and Destructive Incident Decisions
2. Scope, Contain, and Recover

Containment, Eradication, and Safe Recovery

Choose actions that interrupt harm, remove the cause, restore trustworthy operations, and verify that the incident has not simply resumed.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Select and justify containment, eradication, recovery, and validation actions for an incident while documenting their evidence and business trade-offs.

Containment, Eradication, and Safe Recovery

This lesson explains the relationship between containment, eradication, recovery, and validation, including the common trade-offs between speed, evidence, and service availability.

Containment should interrupt the incident with the least necessary disruption

Containment limits ongoing harm and adversary activity. Common actions include revoking sessions, disabling or resetting a compromised account, isolating a device, blocking a destination, restricting an application integration, removing a public exposure, pausing a deployment, or segmenting a network path. The right action depends on what is known, what may be affected, and how the action changes business operations.

Choose containment by comparing urgency, confidence, scope, reversibility, evidence impact, and service consequence. A strong account-compromise signal on a privileged identity may justify immediate session revocation and disablement. An uncertain alert on a production system may call for a temporary restriction, closer monitoring, and rapid owner engagement. Do not let fear of disruption become an excuse for inaction when evidence shows active harm.

Plan alternatives. If taking a system offline is not feasible, can access be narrowed, high-risk functions paused, credentials rotated, or traffic restricted? If a cloud role may be abused, can it be removed without blocking emergency recovery? If a device contains valuable volatile evidence, can a controlled capture happen before isolation? Explain the chosen trade-off in the incident record.

Containment is not eradication. Blocking one IP, deleting one file, or resetting one password may remove a visible symptom while leaving persistence, a stolen token, a vulnerable path, or another compromised identity. Use containment to create time and safety for the next phase.

Select containment by balancing evidence, urgency, scope, and service impactA compass shows four factors used to select a proportionate containment action.Containment is a risk decision, not a reflexCONTAINlimit harm and buy timeURGENCYSCOPEEVIDENCESERVICE IMPACT
Select containment by balancing evidence, urgency, scope, and service impact — A decision compass helps response teams choose a proportionate containment option instead of applying the same disruptive action to every signal.

Recover to a trusted state and verify the result

Eradication addresses the cause or persistence mechanism that enabled the incident. It may involve removing malware, rebuilding a system, patching a vulnerability, rotating secrets, removing unauthorized identities, correcting configuration, closing an exposed service, or replacing a compromised dependency. Do not declare eradication merely because the most visible alert stopped.

Recovery restores required services and capabilities to a trusted state. It should use known-good images, configurations, backups, and credentials where possible. Assess whether a backup point could contain the same compromise, whether a restored identity has appropriate privileges, whether security tooling is active, and whether critical integrations or logging are intact. Restoring data without restoring trustworthy access and monitoring can recreate exposure.

Validate outcomes with defined criteria. Confirm that the affected service is functional, the original path is closed, required controls are active, relevant identities or sessions are remediated, monitoring is in place, and no evidence indicates ongoing activity. Maintain heightened observation for a proportionate period after recovery, especially when the scope or attacker capability remains uncertain.

Recovery has human and business dimensions. Explain service availability, user actions, expected symptoms, remaining limitations, and escalation paths. A technically restored system may still fail operationally if owners do not know it is safe to use or if users continue to follow a compromised process.

Recovery restores a trusted operating state, then verifies itA layered process moves from containment to eradication, known-good restoration, validation, and heightened monitoring.Recovery is complete only when the state is trusted and verifiedCONTAINERADICATERESTOREVALIDATEMONITORKnown-good inputs, corrected cause, working service, active controls, and observable outcomes.
Recovery restores a trusted operating state, then verifies it — A layered recovery flow moves from containment through eradication and known-good restoration to validation and heightened monitoring.
← Previous: Scope the Incident and Preserve Useful Evidence Next: Incident Communication and Coordination →