Question

What is the risk of starting to contain an incident prior to completing the identification process?

Answer 1

The following risks are involved to complete identification process

• We will get an unidentified data
• The data will be uncertain
• The data will not be precised

Answer 2

There is no risk of starting to contain an incident prior to completing the identification process because it is just taking precautionary measures. Containing the incident before the identification process is completed cannot cause a negative outcome particularly if there is a hint that something is wrong.