The FIRST priority when responding to a major security incident is:

A.
documentation.

B.
monitoring.

C.
restoration.

D.
containment.

Explanation:

The first priority in responding to a security incident is to contain it to limit the impact.
Documentation, monitoring and restoration are all important, but they should follow containment.