Incident Measures

Containment and remediation actions on an incident are both recorded as measures, and both open the same measure panel. A containment measure stops or limits the breach; a remediation measure is a corrective or preventive action that stops the incident recurring. This page covers the shared measure panel and the incident-level containment confirmation that rolls the measures up.

The Measure Panel

Both the Containment and Remediation tabs open the same measure panel. It carries the measure title, a status badge, lifecycle buttons, and a Discussion button for threaded comments. It has two tabs:

• Details — edit the description (required), type, effectiveness assessment, responsible owner (people picker), the primary date (Taken on for containment or Target date for remediation), completed date, and notes.
• Progress log — a running history of dated, attributed update notes. Add one with the note box and Add update.

In Add mode the panel shows the Details form only; saving creates the measure and returns you to the tab.

(screenshot placeholder — capture: the measure panel with the Details tab, status badge, Start / Mark complete / Reopen lifecycle buttons, and the Progress log tab)

Measure Lifecycle

Move a measure through its lifecycle with the panel buttons:

1. Start — begins work on the measure.
2. Mark complete — closes it out and stamps today's date automatically.
3. Reopen — returns a completed measure to open.

Measures are a permanent part of the incident record. They can be edited but not deleted, so the containment and remediation history stays intact.

Confirming Containment

The Containment tab carries a summary card that rolls up the measures (planned / in progress / completed) along with the incident-level Containment confirmed toggle and an overall effectiveness rating.

1. Add each action with Add containment measure — these open the measure panel described above.
2. When the breach is contained, switch on Containment confirmed. If any measures are still open, a dialog warns you and asks you to confirm.
3. Confirming stamps who confirmed it and the date, shown with a green shield in the incident header.
4. If your tenant has a Contained status configured, a one-click Set status to Contained suggestion appears after you confirm.

To reverse a confirmation, switch the toggle off. A reason is mandatory, and the original containment date is preserved.

Overall Effectiveness

The containment summary card also carries an overall effectiveness rating for the containment as a whole, separate from the per-measure effectiveness assessment recorded on each measure's Details tab.