An information security manager reads a media report of a new type of malware attack. Who should be notified FIRST?