ECIH recognizes that containment strategies must consider operational impact, evidence preservation, and attacker behavior. In this OT environment, the organization specifically needs to restrict lateral movement without revealing that defenders have detected the attacker. Selectively disabling services associated with the attack while continuing passive monitoring provides controlled, low-profile containment. It can restrict the adversary ' s movement while allowing responders to observe persistence mechanisms, communications, and attempted exfiltration and preserve valuable forensic evidence. A system-wide shutdown would be highly disruptive to production and immediately alert the attacker. Restoring from backup is a recovery action and could destroy evidence or reintroduce compromise before the threat is understood. An organization-wide credential-change announcement would likewise expose the response effort. Therefore, selective service restriction combined with passive monitoring best satisfies the required stealth-containment objective.

================