Endpoint and removable media: decide containment and evidence preservation before device action
Download this document free
Get this document with your free trial. Choose from the full Complyzard library.
Try 1 month free30 days free, then $19/month. Trial terms apply. Card required. Cancel anytime.Document information
When compromise is suspected, the fastest technical action may conflict with containment, evidence, service, legal, or safety needs because disconnecting a device may stop lateral movement but end a volatile session or prevent remote collection.
- Document type
- Procedure
- Format
- DOCX
- Pages
- 2
- Language
- English
- Version
- 1.0
- Updated
- 2026-09-15
- Category
- Information security
- Licence
- Internal use
Description
When compromise is suspected, the fastest technical action may conflict with containment, evidence, service, legal, or safety needs because disconnecting a device may stop lateral movement but end a volatile session or prevent remote collection.
Contents
- Decide containment and evidence preservation before device action
- Record for this use
Version history
- v1.015/09/2026