The securit

y operations team is conducting a mock forensics investigation. Which of the following should be the FIRST action taken after seizing a compromised workstation?

A. Activate the escalation checklist

B. Implement the incident response plan

C. Analyze the fo

rensic image

D. Perform evidence acquisition

Reference