A manager suspects a user has obtained movies protected by copyright using a torrent client. An incident response technician responds and verifies the user has
indeed been violating company policy. Which of the following would be the next BEST step for this technician to perform?
A.
Secure the workstation in a limited access facility.
B.
Document the incident, purge all policy violating materials.
C.
Immediately delete all unauthorized materials.
D.
Reprimand the user and apply a content filter to their profile.