During the response to a ransomware incident, forensic analysis confirms that a nation-state-linked threat actor exfiltrated customer PII and intellectual property. The CISO is preparing a communication plan. Legal counsel advises that the organization may wish to pursue attribution support and preserve options for prosecution, while also meeting a contractual obligation to notify a federal partner. Which action should the CISO prioritize when deciding whether to involve law enforcement?