Containment is the critical step to perform immediately after identification to prevent further damage or spread of the breach. Preparation is what needs to be put in place before an incident occurs. Eradication and Recovery are subsequent steps that occur after containment has successfully halted the spreading of the breach.