An energy company discovers unusual data transmission patterns in its IoT-based smart grid system, suggesting...

Explanation (OT/IoT incident handling):

For smart grid and IoT/OT environments, the first step is to activate the dedicated incident response process that prioritizes safety and continuity while isolating affected components. Immediate shutdown (A) can create operational and safety consequences and should be reserved for clear safety threats. Firmware updates (B) are risky during an active incident; updating can brick devices, change system states, and destroy evidence while not guaranteeing removal of compromise. Third-party engagement (D) can help, but it’s not the first operational step—your internal playbook must begin containment now.

(C) correctly focuses on isolating affected devices/segments, limiting lateral movement, and preserving operational stability. In practice, this can include network segmentation, blocking suspicious outbound communications, switching to manual controls where necessary, and capturing logs/telemetry before making changes. This aligns with common containment strategy: stop spread first, then analyze/eradicate, then recover with validated clean states.