A user is suspected of engaging in prohibited activity on their workstation. Which of the following should be done FIRST?
A. Inform a supervisor or management.
B. Disable network access for the user.
C. Search the workstation for evidence.
D. Call the authorities to question the user.