Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is Containment in Incident Response?

Definition

Containment is the stage of incident response where you stop an attack from spreading or doing more damage, for example by disconnecting a computer, disabling an account, or taking a website offline. It buys time to investigate and plan the cleanup. Good containment limits harm without destroying the evidence you will need later.

How It Works

NIST's incident handling guide (SP 800-61 Revision 2) calls containment mostly a matter of decision-making: shut a system down, disconnect it from the network, or disable certain functions. It recommends choosing a strategy for each major incident type in advance, weighing:

  • potential damage to and theft of resources
  • the need to preserve evidence
  • service availability (what customers lose while it is down)
  • time and resources needed
  • how complete the containment is (partial or full)
  • how long the fix lasts (a four-hour workaround or a permanent change)

CISA's incident response playbook lists typical actions: isolate affected systems and network segments, capture forensic images to preserve evidence, update firewall rules, block unauthorized access and malware sources, close specific ports or servers, and change admin passwords, rotate keys, and revoke privileged access where compromise is suspected.

Two cautions. First, attackers watch for a response. CISA advises isolating systems in a coordinated way and using out-of-band communication, such as phone calls, so you do not tip them off. Second, containment can trigger damage: NIST gives the example of malware that wipes or encrypts a disk when it loses its network connection. Powering a machine off also erases evidence held in memory, so CISA recommends it only when you cannot disconnect the device another way.

Real-World Example

On December 13, 2020, after the SolarWinds Orion supply chain compromise came to light, CISA issued Emergency Directive 21-01 to federal civilian agencies. The order was explicit. Agencies with the expertise were told to first forensically image system memory and host operating systems running affected Orion versions (2019.4 through 2020.2.1 HF1). Then all affected agencies had to immediately disconnect or power down those Orion products, block traffic to and from outside hosts running any version of Orion, and not rejoin the hosts to the enterprise domain until CISA issued rebuild guidance. CISA wrote that disconnecting was "the only known mitigation measure currently available." It is a clear template: preserve, isolate, block, and do not reconnect until you are told it is safe. CISA has since closed the directive.

Why It Matters for a Small Business

Containment is where the most expensive mistakes happen. Wiping a hacked laptop or restoring a website over the top of the infection feels like progress, but it destroys the evidence that shows how the attacker got in, which means you may not be able to close the hole or answer your insurer. Waiting too long has the opposite cost: ransomware spreads to the file server, or a phished mailbox sends fraudulent invoices to every customer. For a small business with no security team, deciding these trade-offs before an incident is one of the most useful parts of an incident response plan.

How to Spot It / How DTS Handles It

You need containment the moment you confirm an incident: a ransom note, a rogue admin account, a site serving spam, or a mailbox sending messages nobody wrote. Do not delete anything yet.

On a WordPress site, DTS typically takes a full file and database snapshot first and keeps the site up, then restricts admin access and disables suspect accounts. Cleanup, and the rotation of passwords and salts that goes with it, waits for the owner's approval. For offices, we isolate affected machines at the switch or Wi-Fi level. See our WordPress incident response package and what to do in the first 24 hours after a WordPress hack.

Related Terms

  • Triage: the decision that triggers containment.
  • Forensic image (snapshot): the copy you take before you isolate or change anything.
  • Eradication: the next step, removing the attacker for good.
  • Chain of custody: documenting the evidence containment preserves.
  • Ransomware: the incident type where containment speed matters most.
  • Supply chain attack: the SolarWinds case behind the example above.

Sources

  • NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide (Section 3.3.1, Choosing a Containment Strategy; withdrawn April 3, 2025 and superseded by Rev. 3): https://csrc.nist.gov/pubs/sp/800/61/r2/final
  • CISA, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (Containment, p. 14): https://www.cisa.gov/resources-tools/resources/federal-government-cybersecurity-incident-and-vulnerability-response-playbooks
  • CISA, Emergency Directive 21-01, Mitigate SolarWinds Orion Code Compromise (December 13, 2020; now closed): https://www.cisa.gov/news-events/directives/ed-21-01-mitigate-solarwinds-orion-code-compromise
  • CISA and MS-ISAC, #StopRansomware Guide (Part 2, Detection and Analysis): https://www.cisa.gov/stopransomware/ransomware-guide

Last updated October 14, 2026.