Forensic artifacts must remain reliable for a later authorized investigation. Which approach best fits?

1. Assess operational impact and coordinate the risk-based containment choice.
2. Communicate scoped status and impact through the approved notification process.
3. Preserve integrity, provenance, access controls, and appropriate chain-of-custody records.
4. Address the underlying configuration pattern and validate related resources.