A suspected insider incident involves the employee who normally administers the affected logs. What should the manager arrange?

1. Appropriately independent evidence preservation and controlled access with legal/HR coordination
2. Ask only the implicated employee to decide which logs matter
3. Notify every employee of the allegation immediately
4. Delete the account and all associated records before collection