What is the first thing that should be done during the containment step of incident handling?

Changing passwords is a remediation/eradication action that comes after containment is established, not the first containment step.

Securing the area is the first containment action because it protects the physical scene, preserves forensic evidence integrity, and prevents tampering before any other steps are taken. According to incident response frameworks, physical security of the affected environment must precede technical or administrative actions. Without securing the area first, evidence could be contaminated or destroyed, compromising the entire investigation.

Preparing the jump bag is a preparation-phase activity that should already be done before an incident occurs.

Notifying management is important but follows securing the area - you need situational awareness before escalating.

Preparing a report is a post-incident activity that occurs during the lessons-learned phase, not containment.