The answer is incident containment. Incident containment is a function that helps to limit and prevent further damage from happening along with certifying that there is no destruction of forensic evidence that may be needed for legal actions against the attackers later. (CSIRT) is Computer Security Incident Response Team.
