Process by which the csirt acts to limit the scale and scope of an incident as it begins to regain control over the organization s information assets.

The answer is incident containment. Incident containment is a function that helps to limit and prevent further damage from happening along with certifying that there is no destruction of forensic evidence that may be needed for legal actions against the attackers later. (CSIRT) is Computer Security Incident Response Team.