A user is suspected of engaging in prohibited activity on their workstation. Which of the following should be done FIRST?

A.
Inform a supervisor or management.

B.
Disable network access for the user.

C.
Search the workstation for evidence.

D.
Call the authorities to question the user.