A security analyst is investigating a potential reach. Upon gathering, documenting, and securing the evidence, which of the following actions is the NEXT step to minimize the business impact?

Launching an investigation to identify the attacking host is a forensic/attribution task that occurs during analysis, not after evidence collection when business continuity is the priority.

Initiating the incident response plan would have already occurred before evidence gathering began, as evidence collection is itself a step within the incident response process.

Reviewing lessons learned is the final post-incident phase that takes place after the incident has been fully resolved and systems have been restored, not immediately after evidence collection.

Once evidence has been gathered, documented, and secured, the immediate next step to minimize business impact is remediation - removing malware and restoring affected systems to normal operation. This aligns with the incident response lifecycle where containment and eradication follow evidence collection, directly reducing downtime and limiting further damage to the organization.