A company experienced a breach through phishing emails originating from a third-party partner email domain. Multiple employees became infected with ransomware. The incident-response team identified the breach only after data on the critical server was encrypted and web applications crashed. Security engineers requested recovery actions for the affected servers. According to incident-response processes, which two steps did the security staff miss? (Choose two.)