To prevent an incident from overwhelming resources, _ is necessary.
eradication of the issues
disconnection from the network
early containment
continuation of monitoring for other incidents