During ransomware incident response, a SOAR playbook has completed containment (host isolation) and eradication (malware removal, credential rotation). The recovery phase must restore encrypted file servers from backups. The SOC lead wants the playbook to add a step before initiating restore to avoid reintroducing the threat. Which automated step best addresses this risk during recovery?