Answer
Contain the risk while preserving the logs and evidence needed to understand what happened, what data was affected, and whether further compromise remains.
Explanation
Erasing systems too quickly can destroy the information needed for breach assessment and recovery. Incident procedures should define how to preserve evidence safely.