It has been reported to you that someone has caused an information spillage on their computer. You go to the computer, disconnect it from the network, remove the keyboard and mouse, and power it…

Containment is the incident response phase focused on limiting the scope and impact of an incident by preventing it from spreading to other systems or causing further harm. Actions such as disconnecting from the network, removing input devices, and powering down the machine are all classic containment techniques described in NIST SP 800-61. This phase occurs after the incident has been identified and before eradication begins.

Eradication involves removing the root cause of the incident, such as deleting malware or closing vulnerabilities, which has not yet occurred here.

Recovery involves restoring the system to normal operation and returning it to production, which is a later phase that follows eradication.

Discovery (Identification) is the phase where the incident is first detected and reported, which already occurred before the responder arrived at the computer.