Closing an insider incident is which of the following?

A. Faster than closing external-attacker incidents because you can fire the insider.
B. Slower than closing external-attacker incidents because law enforcement investigations take extra time.
C. Similar to closing external-attacker incidents because the same closure process is followed.
D. Rarely closed because insiders can retain special knowledge of your information, systems, and networks