Information Security Handbook

Remediation – containment/recovery/mitigation

Remediation is the point in the process where you, as the incident responder, engage the threat and work to protect the organization from further harm.

We are now at the point in the process where we perform the actions necessary to respond to the threat. This is made possible through the high-quality data made available through the observe and orient tools. We have taken that data and made an appropriate decision based on our organization's mission and legal requirements. With that decision, we implement the appropriate information security tools to do the following:

1. Contain the threat:
   • Initially limiting damage: Ensuring that the attacker is unable, or finds it very difficult, to cause damage ...