A user has contacted the risk practitioner regarding malware spreading laterally across the organization's corporate network. Which of the following is the risk practitioner's BEST course of action?

Reviewing log files is part of the investigation phase but not the immediate first action when active lateral movement is confirmed, as containment is paramount.

Performing a root cause analysis is a post-incident activity, done after the threat has been contained and eradicated, to prevent future occurrences.

Notifying the cybersecurity incident response team is the most critical immediate step when an active incident like malware spreading laterally is identified. This action initiates the formal incident response process, which includes containment, eradication, recovery, and post-incident analysis to mitigate the ongoing threat.

Updating the risk register is a risk management activity that follows an incident, incorporating lessons learned, but it doesn't address the immediate active threat.