An incident response team has been notified of a virus outbreak in a network subnet. The next step should be to focus on limiting the damage by containing the virus and preventing it from spreading further. This may involve isolating the affected systems, disconnecting them from the network, blocking malicious traffic or applying patches or antivirus updates. Verifying that the compromised systems are fully functional, documenting the incident and removing and restoring the affected systems are possible steps that could be taken after limiting the damage. References:
* : [Incident Response Definition]
* : [Incident Response Process | ISACA]
* : [Virus Definition]