You are a member of St$.$ Eligius$$s CSIRT. You have received information suggesting that Bob in Accounting has been accessing patient data inappropriately. You have attained the necessary approvals from the CISO and Legal, and you have begun an examination of Bob$$s email and workstation. In the course of the investigation, you uncover an email that suggests Bob is working in collusion with Alice in Finance. What should you do next?

You are a member of St$.$ Eligius$$s CSIRT. You have received information suggesting that Bob in Accounting has been accessing patient data inappropriately. You have attained the necessary approvals from the CISO and Legal, and you have begun an examination of Bob$$s email and workstation. In the course of the investigation, you uncover an email that suggests Bob is working in collusion with Alice in Finance. What should you do next?

report the finding to Alice$$s supervisor and request clarification of Alice$$s actions

ignore the finding, because you were tasked only with investigating Bob$$s activity

begin an examination of Alice$$s email and workstation

report the information to the CISO and Legal and request approval to examine Alice$$s activity