An information security manager has been alerted to a possible incident involving a breach at one of the organization's vendors. Which of the following should be done FIRST?

A. Discontinue the relationship with the vendor.
B. Perform incident recovery.
C. Perform incident eradication.
D. Engage the incident response team.