Illegal content is not permitted on work computers, according to company policy. You have discovered and confirmed the presence of illegal content on a user's workstation. What should you do?

Your incident response plan should be relatively scripted if your policy is in place. Finding the improper activity or content is your top priority as the first responder. Then, you should always ask someone else to confirm the material or action so that your word won't be held against anyone else's. Report the incident through the appropriate channels as soon as possible, and secure the drive away from the user.