In change management, which step focuses on limiting impact by isolating and containing issues during an incident?

• A. Recovery
• B. Containment
• C. Eradication
• D. Preparation

Answer: (B)

Containment focuses on limiting impact by isolating affected systems and stopping the incident from spreading. By cutting off the paths an issue uses—such as isolating compromised machines, blocking malicious access, or applying temporary safeguards—you stabilize the environment and create a safe window for investigation and remediation. Recovery comes after containment and works to restore services, while eradication aims to remove the root cause from the environment, and preparation is about getting things ready before an incident occurs. So containment is the best fit because its primary goal is to stop further harm and buy time for proper analysis and fix.