A mid-sized company just experienced a ransomware incident. During the response, analysts wasted valuable time because two team members both attempted to lead containment while no one contacted legal counsel until hours into the event. The post-incident review notes technical detection worked well, but coordination broke down. As the CSIRT lead planning improvements to the preparation phase, which action most directly addresses the identified problem?