A confirmed attacker is actively encrypting a critical file server. An approved playbook authorizes isolation, and isolation will interrupt service. What is the best immediate action?

1. Keep the server connected until a complete forensic report is written
2. Apply the authorized containment while coordinating the business impact
3. Publish a lessons-learned report before containment
4. Delete all encrypted files to restore confidence