During an ongoing investigation, a security analyst has been informed that a legal hold has been placed on data related to a specific project. What should be the FIRST step the analyst takes to ensure preservation of relevant data in compliance with the legal hold?
Initialize immediate backups of all data sets mentioned in the legal hold.
Suspend automatic data deletion or archiving policies for the data sets involved.
Shut down any systems that house the data sets under legal hold to prevent further data modification.
Encrypt the data sets in scope to prevent unauthorized access.