The team needs to preserve volatile evidence from a running host while stopping active harm. What should guide the decision?

1. Always keep a harmful host online indefinitely
2. The approved response plan, evidence value, harm, and authorized expert judgment
3. Always power off every host before considering evidence
4. Let a supplier salesperson decide