Which of the following is a step Incident Handling & Response personnel should follow to contain malware incidents?

Question $12$ options:

Subscribe and regularly read antivirus bulletins

Separate the compromised host $($system$)$ from the operational network.

Establish a malicious code security policy

Educate users about malicious code security issues