RS.MI-01 says incidents are contained. Containment limits how far an incident spreads and how much damage it does, usually before you fully understand it.
What good looks like
Responders can act quickly without hunting for permissions. Some containment is automatic, such as endpoint protection quarantining a file or an identity provider blocking a risky sign in. Some is manual and pre approved: disable an account, revoke a token, isolate a host, block an address, pause a deploy pipeline. Where you rely on a third party such as an internet provider or managed security provider, the contract and contact path are known.
How to implement it
- List containment actions per incident type and who may take each one without asking.
- Make sure the tooling exists: remote isolation on endpoints, the ability to disable accounts and revoke sessions centrally, firewall rule changes on short notice.
- Where practical, move compromised endpoints to a quarantine network segment.
- Rotate credentials and keys that may have been exposed as part of containment.
- Document the side effects of each action so the lead can weigh disruption.
- Rehearse with a tabletop that includes one containment decision under uncertainty.
Evidence to collect
- Containment playbooks with authorized roles.
- Tool configuration showing isolation and automated response are enabled.
- Incident tickets with containment actions and timestamps.
- Third party agreements covering containment support.
Common gaps
- Only one administrator can disable accounts.
- Containment requires a change request that takes a day.
- Credentials are reset but old sessions and API keys stay valid.
- Nobody has tried isolating a host before the real event.
A worked example
An engineer's laptop starts beaconing to an unknown address. Endpoint protection flags it and, because automated containment is enabled, cuts the laptop off from the network except for the management channel. That is the automatic layer.
The on call responder confirms the alert is real and uses the pre approved manual list. They disable the engineer's accounts, revoke active sessions and tokens, and rotate the CI token that was stored on the machine. They do not need anyone's permission for these steps, and the ticket records each action with a time.
The responder then checks the side effects noted in the playbook. Disabling the account will break the engineer's scheduled deployments, so the lead informs the team and arranges a temporary owner. The managed security provider, whose contract covers firewall changes, is asked to block the destination address on the perimeter. That is the third party layer, used within its agreed scope.
Total elapsed time from alert to containment is under an hour, because the choices were made months earlier.
How to start this week
- Check who can disable an account and revoke sessions in each critical system, including after hours. Make sure it is at least two people.
- Confirm remote isolation works on a test endpoint. Do it once so the first real use is not the first try.
- Write down the five containment actions you would take for account compromise and the side effects of each.
- Read the incident clause in your managed provider contract and note what they may do without asking you.
Questions auditors and customers ask
- How fast can you cut off a compromised account or device? Show the playbook and a timed exercise.
- Who is allowed to take containment actions? Show the authorization list.
- What do you do when a supplier holds the control? Show the contract and the contact path.
Quick check
Should containment wait for a full diagnosis?
No. Contain on the best current evidence, then refine. Pre approved actions exist so the team does not wait.
What is the common miss with account compromise?
Resetting the password but leaving active sessions, tokens and mail forwarding rules in place.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 implementation examples for RS.MI-01, as listed in the CSF 2.0 Reference Tool: https://www.nist.gov/cyberframework
CSF is voluntary guidance. There is no CSF certification, so use it to organize and show your own work.
