An organization's incident response team has successfully contained a data breach incident. Which of the following actions is the MOST appropriate next step to ensure that the digital evidence remains intact for forensic analysis?
Creating a forensic image of affected systems
Performing secure backups of affected systems
Disconnecting compromised systems from the network
Turning off systems to ensure data is not tampered with