An audit has determined that employee use of personal mobile devices to access the company email system is resulting in confidential data leakage. The information security manager’s FIRST course of action should be to:

A. treat the situation as a security incident to determine appropriate response
B. implement a data leakage prevention tool to stem further loss.
C. isolate the mobile devices on the network for further investigation.
D. treat the situation as a new risk and update the security risk register.