When an intrusion into an organization’s network is detected, which of the following should be performed FIRST?

A. Block all compromised network nodes.
B. Protect information in the compromised systems.
C. Develop a response to the incident.
D. Identify nodes that have been compromised.