An administrator responded to an incident where an employee copied financial data to a portable hard drive and then left the company with the data. The administrator documented the movement of the evidence. Which of the following concepts did the administrator demonstrate?


A. Preserving chain of custody
B. Implementing data protection policies
C. Informing law enforcement
D. Creating a summary of the incident