Which of the following should be done FIRST once a cybersecurity attack has been confirmed?

Isolating the affected system is crucial to prevent the attack from spreading to other systems or networks, thus limiting the scope and potential damage of the incident. This containment step helps preserve evidence and allows for more controlled analysis and remediation.

Powering down the system might destroy volatile data crucial for forensic analysis and could also disrupt critical business services, so isolation is generally preferred over immediate shutdown.

Notifying senior management is important, but containment (isolation) should precede notification to prevent further damage while management is being informed and plans are being made.

Contacting legal authorities is a later step in the incident response process, typically after initial containment, assessment, and potentially some investigation, when enough information is gathered to make such a report.