An organization experiences a ransomware attack that encrypts critical data. The incident response team isolates affected systems. What is the NEXT step?