The Chief Executive Officer (CEO) of a corporation purchased the latest mobile device and wants to connect it to the company's internal network. The Chief Information Security Officer (CISO) was…

Relying on a corporate policy to prevent sensitive data on the device does not technically enforce that restriction, and antivirus software does not protect data if the device is physically lost.

Encryption of non-volatile memory combined with a policy lacks a technical access control - a policy alone cannot prevent someone who finds the device from accessing it without a PIN or password requirement.

Encrypting non-volatile memory protects sensitive data stored on the device from being accessed if the device is lost or stolen by rendering it unreadable without the decryption key, while a password or PIN ensures that an unauthorized person cannot unlock and use the device, together forming a layered technical defense for device loss scenarios.

A PIN combined with a policy provides access control but leaves stored data unprotected if the PIN is bypassed or the storage is removed and accessed directly without encryption.