Does your incident response process allow responders to manually select and execute containment actions during security incidents?

Effective incident response requires the ability for responders to make real-time decisions about how to contain threats based on the specific nature of each incident.

Manual containment options might include isolating affected systems from the network, suspending compromised accounts, blocking specific IP addresses, or shutting down vulnerable services.

These capabilities are essential because automated responses may not be appropriate for all scenarios and could potentially cause business disruption if not carefully managed.

Evidence could include incident response playbooks that outline available containment options, screenshots of security tools that provide manual containment capabilities, documentation of access controls showing that incident responders have appropriate permissions to execute containment actions, or post-incident reports demonstrating where manual containment was performed.