Predetermined containment methods to be used in a cybersecurity incident response should be based PRIMARILY on the:

While incident handler capabilities are important for executing the plan, the *methods themselves* are designed for the incident type, not primarily based on the varying skill levels of individuals.

Effective containment strategies vary significantly depending on the nature of the incident; for example, isolating a system infected with ransomware requires different actions than containing a denial-of-service attack or a data exfiltration attempt. Incident response plans predefine these methods by incident type to ensure a rapid and appropriate initial response.

Predicted incident duration is an outcome or a factor in overall management, but it doesn't primarily define the technical containment actions themselves.

The number of impacted users might influence prioritization and communication, but it doesn't fundamentally change the technical steps required to contain the specific threat.