If a user’s device is compromised, it is best practice to FIRST:

If a user’s device is compromised, it is best practice to FIRST:
A. Wipe the device.
B. Capture the logs.
C. Lock the device.
D. Document the incident.