You recently started a job as the CISO in a Maryland$-$based medium sized organization that handles large amounts of financial data for the US government. Which law from $1999$ should you be cognizant off?

In your first week, you receive a report that an employee has been observed exfiltrating large amounts of data. What should you do and which policy document applies? Walk through the steps that you would take immediately and then what you would implement afterwards.