A company uses an internal investigation team and outside counsel during major incidents. To reduce email overload, executives begin discussing response strategy and legal risk inside a collaboration platform with auto retention and global search enabled.
No breach has occurred yet. What is the MOST appropriate action to take FIRST?
A. Disable search and retention features for executive channels
B. Move all sensitive discussions to encrypted messaging tools
C. Establish formal communication boundaries and privilege handling procedures
D. Require legal approval before any executive incident discussion