Which of the following should be performed FIRST after discovering an employee is using a corporate laptop to steal trade secrets?

Disabling the laptop without proper reporting or authorization could destroy volatile evidence or impede a forensic investigation.

While preserving data is crucial, it should follow incident reporting to ensure all actions are legally sound and approved.

In an incident involving illegal activity like trade secret theft, the absolute first step is to report the incident to the appropriate internal stakeholders (e.g., HR, legal, management) and potentially external law enforcement, depending on company policy and the severity. This ensures legal compliance, proper authorization for subsequent actions, and adherence to the incident response plan.

Tracking evidence is part of the investigation phase, which follows the initial reporting and assessment, and must be done carefully to maintain the chain of custody.