Which incident handling is focused on minimizing the impact of an incident?

Scoping is concerned with determining the full extent and boundaries of an incident, not with stopping or limiting its damage.

Reporting involves communicating incident details to stakeholders and authorities, which is a documentation and notification activity rather than a damage-limiting one.

Containment, as defined in NIST SP 800-61, is the phase where responders take immediate action to stop an incident from spreading further and reduce its damage - for example by isolating affected systems, blocking malicious IPs, or disabling compromised accounts. It is explicitly focused on minimizing impact before eradication and recovery begin.

Eradication focuses on completely removing the threat (malware, backdoors, compromised credentials) after containment has already limited the impact.