An isolation action is a containment measure that separates a suspected compromised device or system from other parts of a network or operation. It may involve disconnecting a device, blocking its communications, or moving it into a restricted network segment. The aim is to limit an attack’s spread while responders investigate.
In operational technology (OT), isolation can disrupt physical processes, safety systems, or essential services, so it must be governed by strict procedures. Defenders should understand the asset’s role and dependencies, define who can authorize isolation, and test response plans in advance. In practice, a detection tool may recommend or trigger isolation, but automated action should be used only when its effects are understood and operational controls permit it.