Containment Action Catalogue — Template
The charter, at §4, states what the CDC may do; this catalogue makes it operational: one row per concrete containment action, with its enforcement point, automation status, and whether the mandate is pre-agreed or needs per-case approval. Review at least semi-annually and tie it to a control. Stale mandates are discovered at 03:00.
Who may order it follows the action's impact, not the seniority of whoever is awake: the CDC on duty for actions that affect single users or endpoints, the service owner for actions that affect a service, and the executive named in charter §4 for actions with estate-wide, regulatory or public consequences. The values below are suggestions; set your own and mirror them in the IR plan's decision authority table.
| ID | Action | Enforcement point | Automated? | Pre-mandated? | Who may order it | Requires stakeholder interaction? | Notes / limits |
|---|---|---|---|---|---|---|---|
| CON-01 | Block domain | Proxy / DNS filtering | ☐ | ☐ | CDC on duty | ☐ | |
| CON-02 | Block domain, or sinkhole it | DNS | ☐ | ☐ | CDC on duty | ☐ | |
| CON-03 | Block IP | Perimeter firewall | ☐ | ☐ | CDC on duty | ☐ | |
| CON-04 | Block file hash | EDR / AV | ☐ | ☐ | CDC on duty | ☐ | |
| CON-05 | Isolate endpoint | EDR | ☐ | ☐ | CDC on duty | ☐ | e.g., workstations pre-mandated; servers per tier |
| CON-06 | Isolate server at tier ≥ X | EDR / hypervisor / switch | ☐ | ☐ | Service owner; executive for crown jewels | ☑ typically | Crown jewels: approval per charter §4 |
| CON-07 | Disable / lock user account | Directory / IdP | ☐ | ☐ | CDC on duty | ☐ | Pair with session/token revocation |
| CON-08 | Revoke sessions & refresh tokens | IdP / cloud | ☐ | ☐ | CDC on duty | ☐ | |
| CON-09 | Block mail sender / recall mail | Mail gateway / mail platform | ☐ | ☐ | CDC on duty | ☐ | |
| CON-10 | Disable service account / rotate secret | Secrets mgmt / directory | ☐ | ☐ | Service owner | ☑ typically | Coordinate with service owner |
| CON-11 | Cut external connectivity with a deny-all at the perimeter | Perimeter firewall | ☐ | ☐ | Executive | ☑ typically | Estate- or site-wide Availability impact; approval per charter §4. Drill it: deciding this at 03:00 without a mandate is how hours are lost |
| CON-12 | Disable remote access: client VPN, site-to-site, RDP/VDI gateways, vendor and OOB management | VPN / gateway / firewall | ☐ | ☐ | Executive | ☑ typically | Partial isolation is not isolation, so enumerate every inbound path, including supplier and management ones, before you need the list |
| CON-13 | Isolate backup infrastructure | Backup platform / storage / network | ☐ | ☐ | Service owner | ☑ typically | Confirm recent restore points are readable first. Backup systems are a primary ransomware target and the credentials to reach them are often already held |
| CON-14 | Extend snapshot retention / export snapshots | SAN / hypervisor / storage | ☐ | ☐ | Service owner | ☐ | Defaults roll off in days and take evidence and recovery points with them, so this is a first-hour action, not a recovery-phase one |
| CON-15 | Stand up emergency log collection | Firewall, directory, hypervisor, mail, remote access | ☐ | ☐ | CDC on duty | ☐ | For estates without central logging: pull logs somewhere the adversary cannot reach, before they rotate |
| … |
Governance: owner: [role] · review frequency: [semi-annual] · approver from outside the CDC: [function] · last reviewed: [date] Temporary actions: every action taken in an incident is listed in the case, and at debrief it is either removed or made permanent through normal change management. A forgotten block or an isolated host becomes the next outage. Operating-model note: in MSSP/hybrid models, add a column "who may execute" with the options MSSP autonomously, MSSP on approval, or internal only. Mirror the MSSP checklist's response-boundary matrix.
Template from the Open CDC Framework, licensed CC BY 4.0.