Incident Management · Topic 4 of 5
Incident Investigation, Evaluation and Containment
Investigating and evaluating security incidents, preserving evidence with chain of custody, and containment methods that limit damage and keep evidence.
- 3 min
- Investigation establishes scope, cause and impact; evaluation drives decisions.
- Preserve evidence: chain of custody, order of volatility, images, hashes.
- Containment options: isolate, segment, disable accounts, block, shut down.
What it is
Investigation and evaluation establish what happened, how, what was affected and how serious it is. Containment limits the spread and damage of an incident while the cause is removed. The two run together: containment decisions depend on what the investigation finds, and investigation needs evidence that containment must not destroy.
How it works
Investigation and evaluation
The team answers key questions: what systems and data are affected, how the attacker got in, what they did, whether they are still present, and what the business impact is. Sources include logs, EDR data, network traffic, user interviews and threat intelligence.
Evaluation turns findings into decisions: confirming or changing the severity, deciding whether regulators or customers must be notified, and whether to involve law enforcement or external forensic specialists. Legal counsel should be involved early when the incident may involve personal data, crime or litigation.
Evidence handling
| Practice | Why |
|---|---|
| Chain of custody | Records who handled evidence and when, so it is admissible and trusted |
| Order of volatility | Capture memory and live system state before disk and logs |
| Forensic images | Analyze copies, not originals |
| Hash values | Prove evidence has not been changed |
| Documentation | Record every action and time |
Containment methods
| Method | Example |
|---|---|
| Isolation | Disconnect an infected host from the network, often through EDR |
| Segmentation | Block traffic between network zones |
| Account actions | Disable compromised accounts, reset credentials, revoke tokens and sessions |
| Blocking | Block malicious domains, IP addresses or file hashes |
| Service shutdown | Take a service offline when the risk is greater than the cost of downtime |
| Monitoring in place | In some cases, observe an attacker to learn their scope before acting |
Choosing a containment strategy
The choice weighs the damage that could continue, the need to preserve evidence, service availability, the time and resources needed, and how well the threat is understood. Short-term containment stops immediate spread; longer-term containment keeps the environment safe while eradication is prepared. The decision to shut down a critical service is a business decision taken by the authority named in the plan.
When malware is spreading, containment comes first. Wiping and rebuilding immediately may stop the spread but destroys the evidence needed to find the root cause and other affected systems.
How the exam asks about this
- "Ransomware is spreading between file servers. What FIRST?" Contain it by isolating affected systems.
- "Who decides to take a revenue-generating service offline?" The business authority defined in the incident response plan, advised by the security manager.
- "Why involve legal counsel early?" Notification duties, evidence requirements and potential litigation.
What to remember for the exam
- Investigation establishes scope, cause and impact; evaluation drives decisions.
- Preserve evidence: chain of custody, order of volatility, images, hashes.
- Containment options: isolate, segment, disable accounts, block, shut down.
- Balance damage, evidence, availability and resources.
- Business owners decide on major service shutdowns, per the plan.
Alerting a suspected insider or an active attacker before scope is understood can lead them to destroy evidence or move deeper.
Common mistakes
Rebuilding systems before evidence is captured.
Containing one host without finding others affected.
Leaving legal and notification decisions until the end.
Check yourself
What does chain of custody show?
Who handled evidence, when and why, from collection onward.
What is the main goal of containment?
To limit the spread and damage of an incident while it is resolved.
Which evidence should be captured first?
The most volatile, such as memory and live system state.
Topic 4 of 5 in Incident Management
Test yourself on Incident Management
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.