Which of the following should be an IS auditor's PRIMARY focus when evaluating the response process for cyber crimes?

A. Notification to regulators
B. Communication with law enforcement
C. Evidence collection
D. Root cause analysis