Which of the following should be performed FIRST after discovering an employee is using a corporate laptop to steal trade secrets?

Question

Options

• ADisable the laptop
• BPreserve the data
• CReport the incident
• DTrack the evidence

• A
  5% (2)
• B
  8% (3)
• C
  74% (28)
• D
  13% (5)

Explanation

Reporting the incident to management, HR, and/or legal counsel must come first because the response to insider threats involves legal, HR, and compliance considerations - not just technical ones. Acting unilaterally (disabling the laptop, preserving data, or collecting evidence) before notifying the proper authorities can violate legal procedures, compromise a potential prosecution, or create liability for the person who discovered it. Once the incident is reported, designated personnel can authorize and supervise the appropriate technical and legal response, ensuring evidence is handled in a forensically sound and legally admissible way. The chain of custody and any disciplinary or legal action depends on following proper reporting procedures from the very start.

No community discussion yet for this question.