The IT security team of a multinational corporation identifies a breach in its BYOD policy,...

This scenario involves active mobile spyware infections, representing an immediate confidentiality risk. The ECIH Endpoint and Mobile Incident Handling guidance prioritizes containment when active compromise is detected.

Option C is correct because disconnecting infected devices immediately prevents further data leakage and lateral movement. Initiating forensic analysis allows responders to determine scope, data accessed, and persistence mechanisms. ECIH emphasizes that containment must precede long-term control improvements.

Option A is preventive and strategic but not immediate. Option B addresses future behavior. Option D mitigates credential risk but does not stop spyware activity.

Thus, immediate isolation and forensic analysis is the correct first response.