# Containment Decision Record

- Incident / case:
- Decision ID:
- Decision time (UTC):
- Decision owner and authority:
- Recorder:

## Current evidence and uncertainty

- Confirmed facts:
- Working hypothesis:
- Unknowns that could change the decision:
- Active threat or harm:

## Options considered

| Option | Expected risk reduction | Business / safety impact | Evidence impact | Reversibility | Time to execute |
|---|---|---|---|---|---|
| | | | | | |

## Decision

- Selected action and scope:
- Why this option:
- Systems, identities, data, or users affected:
- Execution owner:
- Approval / consultation record:

## Validation and rollback

- Success signals:
- Failure or escalation signals:
- Rollback trigger:
- Rollback action and owner:
- Next review time (UTC):