Containment, eradication, recovery

- Short-term containment (isolate, block, rotate creds) - Long-term eradication (root cause, persistence removal) - Recovery validation (integrity, monitoring elevation) - Communications (internal, customers, regulators, media)