This scenario involves a suspected malicious insider threat with potential external collusion, which significantly elevates legal, regulatory, and evidentiary requirements. The ECIH curriculum emphasizes that when insider activity is suspected—especially involving terminated employees and possible corporate espionage—organizations must prioritize forensic integrity, confidentiality, and lawful investigation.

Option B is correct because collaborating with external forensic experts and law enforcement ensures a neutral, legally defensible investigation. ECIH stresses that insider cases often require specialized forensic capabilities, evidence preservation, and legal authority that internal teams alone may not possess. Maintaining confidentiality protects the organization from reputational damage and legal exposure while facts are being established.

Option A ignores the insider dimension and risks repeat incidents. Option C bypasses legal safeguards and could be interpreted as obstruction or collusion. Option D is premature and exposes the organization to defamation and legal risk without substantiated evidence.

ECIH guidance is clear that complex insider incidents should be escalated appropriately with legal and forensic rigor. Therefore, Option B aligns best with recommended practice.