Isolating the affected systems is the best initial containment step as it prevents the spread of malware to other network resources while preserving the systems for further analysis. Isolation ensures that the organization can maintain business continuity with unaffected systems. Turning off the affected systems might prevent the potential spread but will result in loss of volatile data and impede further investigation, while monitoring the systems does not actively contain the spread. Changing user passwords does not address the malware infection directly and may be a distraction from more urgent containment procedures.