Containment can be narrow or broad. Each choice has a cost to the business. Isolating one host is cheap. Disconnecting the internet or the whole domain stops the attack but halts work.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Decide in advance who can order broad containment
- Prefer targeted isolation when the scope is known
- Reset credentials the attacker may hold
Making it stick
Containment that alerts the attacker too early can make things worse. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.