$1)$ An incident response process has four consecutive steps. These are $(1)$ Recovery and resumption, $(2)$ Review and improvement, $(3)$ Incident detection, and $(4)$ Response and containment. This is not an ordered list. Type these steps in the correct order.

What is the purpose of incident response? Assume the role of SOC $($Security Operation Center$)$ manager. Your company is the victim of a ransomware campaign, and some employees have been receiving targeted phishing emails with malicious attachments. Provide one response action you might take as part of the incident response process?