Which of the following is the MOST appropriate control measure for lost mobile devices?

Disabling Bluetooth is a preventive measure that reduces attack surface but provides no protection once the device is already lost.

Reducing sensitive data stored on the device is a preventive data minimization strategy, not an appropriate response after loss has occurred.

Requiring authentication is a preventive access control that can be bypassed through physical attacks and does not mitigate the risk of a lost device.

Once a mobile device is lost, preventive controls like authentication are no longer sufficient since a determined attacker can bypass them given physical possession and unlimited time. Remote wipe directly addresses the threat by destroying the data on the device, preventing any confidential organizational data from being accessed or exfiltrated. NIST SP 800-124 recommends remote wipe as a primary incident response control for lost or stolen mobile devices.