Suspicious activity was found on one database server, and early log review suggests the attacker may have reached other systems. The business wants that server restored immediately. What should the security manager ensure FIRST so that containment is effective?

Containment is only effective when it covers the full extent of the compromise. Determining scope means identifying which systems, accounts, data and network paths the attacker has used, using logs, endpoint telemetry and indicators of compromise. That information drives containment decisions, prevents the attacker from retaining access through unaddressed footholds and informs assessments of business impact and notification obligations. Rebuilding the one known server and returning it to service may satisfy the immediate business request, but if the attacker holds access elsewhere, the rebuilt server can be recompromised and the attacker alerted, while evidence on the original is lost. Notifying all customers before knowing what data was affected is premature; notification decisions require facts about scope and legal guidance on obligations. Resetting passwords only for the users of one server addresses part of the credential exposure but ignores other accounts the attacker may hold, including privileged and service accounts. Exam caveat: scoping does not mean delaying all action indefinitely; urgent measures may be needed for active harm, but they should be informed by what is known. Operational check: confirm a scope assessment lists affected assets and accounts, with confidence levels, before the containment plan is approved.