After a security incident has been contained, which of the following should be done FIRST?

A. Conduct forensic analysis
B. Notify local authorities
C. Restore the affected system from backup
D. Perform a complete wipe of the affected system