There is no risk of starting to contain an incident prior to completing the identification process because it is just taking precautionary measures. Containing the incident before the identification process is completed cannot cause a negative outcome particularly if there is a hint that something is wrong.
