while investigating a virus infection, a security analyst discovered the following on an employee laptop:

• Multiple folders containing a large number of newly released movies and music files
• Proprietary company data
• A large amount of PHI data
• Unapproved FTP software
• Documents that appear to belong to a competitor

Which of the following should the analyst do FIRST?

• Contact the legal and compliance department for guidance
• Delete the files, remove the FTP software, and notify management
• Back up the files and return the device to the user
• Wipe and reimage the device