A systems administrator is attempting to resolve a ticket regarding an issue with an email server. The administrator is covering for a coworker who was previously working on the ticket. The coworker already gathered facts about the issue and spoke with users concerning their missing emails. The coworker also discovered the email server's retention policy was updated shortly before users first noticed the issue. Which of the following should the systems administrator do NEXT to resolve the email issue?


A. Escalate the ticket to a higher level to resolve the email server issue.
B. Test a theory to determine the cause of the email server issue.
C. Establish a theory of probable cause for the email server issue.
D. Create a plan of action to resolve the email server issue.