If a user’s device is compromised, it is best practice to FIRST:

If a user’s device is compromised, it is best practice to FIRST:

A.
Wipe the device.

B.
Capture the logs.

C.
Lock the device.

D.
Document the incident.

Explanation: