A manager suspects a user has obtained movies protected by copyright using a torrent client. An incident
response technician responds and verifies the user has indeed been violating company policy. Which of the
following would be the next BEST step for this technician to perform?
A.
Secure the workstation in a limited access facility.
B.
Document the incident, purge all policy violating materials.
C.
Immediately delete all unauthorized materials.
D.
Reprimand the user and apply a content filter to their profile.