Ransomware is spreading between endpoints. Which action most directly supports containment under the playbook?

1. Delete backup copies to save space
2. Isolate affected systems from network paths
3. Publish an unverified root-cause statement
4. Disable all logging permanently