How should incident containment actions be documented?

• A. Time-stamped actions, scope of containment, systems affected, credentials disabled, evidence preserved, and stakeholder communications.
• B. Containment actions should be documented in only a small, high-level note.
• C. Documentation should be completed after the incident is closed.
• D. Only the most critical systems need documentation.

Answer: (A)

Documenting containment actions should provide an auditable, actionable record of what was done to limit the incident as it unfolded. The most effective approach includes time-stamped actions, the scope of containment, systems affected, credentials disabled, evidence preserved, and stakeholder communications. This level of detail creates a verifiable timeline, shows exactly which parts of the environment were isolated or protected, clarifies the impact on assets, ensures access controls were properly resecured, preserves the chain of custody for any artifacts, and demonstrates that key stakeholders were informed and involved.

A small, high-level note lacks the needed detail for accountability and forensics. Waiting to document until after the incident is closed can lead to lost details and a weakened audit trail, and focusing only on the most critical systems misses the broader context and could hinder recovery and investigation.