“Disable external access until reviewed.”

We did.

Not his employment.

Not yet.

His credentials.

Then we preserved logs.

Time stamps.

Device information.