Your organization, which operates in a highly regulated industry, is using Microsoft 365 and has identified a potential security threat involving phishing attempts targeting sensitive customer data. The organization must comply with strict data protection regulations. What comprehensive steps should you take to investigate and mitigate the threat effectively, ensuring compliance and minimal disruption to operations? (Choose the best single option)