A containment action could interrupt a critical business service. Responders have time to coordinate the approved decision. Which approach best fits?

1. Communicate scoped status and impact through the approved notification process.
2. Assess operational impact and coordinate the risk-based containment choice.
3. Preserve integrity, provenance, access controls, and appropriate chain-of-custody records.
4. Address the underlying configuration pattern and validate related resources.