Depending on where the threat is, how mobile it is and how it develops, perimeter containment should start when reasonable, first an inner perimeter and then, as resources arrive, an outer one. Because these incidents move quickly and containment is not always possible, early steps should stop people from unknowingly walking into an area under actual or possible threat.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.