How should containment decisions be justified?¶
Link the selected action to a defined risk, the evidence available at the time, reasonable alternatives and the expected balance between harm reduction, evidential loss and service impact.
Explain necessity and proportionality¶
State the occurring or credible harm and its evidential basis: alerts, live activity, user reports, logs or specialist advice. Identify affected people, systems, services and data. Consider narrower controls such as revoking one session, restricting one identity, blocking one destination or isolating one device, and record why they were inadequate, unavailable or too slow.
Assess likely loss of sessions, memory, network visibility, cloud access and unsaved data alongside safety, continuity, communications, customer effects and legal obligations.
Preserve the decision in its original context¶
Record the decision-maker, authority, exact time, available information and significant unknowns. Urgent action before full advice may be reasonable where delay increases harm; document that time pressure rather than judging only with hindsight.
After implementation, test whether the action achieved its purpose and whether further or reduced controls are justified. Temporary emergency measures should not continue indefinitely without review.
Key takeaway
A defensible containment decision shows the risk, contemporaneous evidence, rejected alternatives, expected costs and later review - not merely that the chosen control was technically possible.
