The Chief Executive Officer (CEO) of a corporation purchased the latest mobile device and wants to connect it to the company's internal network. The Chief Information Security Officer (CISO) was…

A corporate policy is an administrative control that relies entirely on user compliance and provides no technical enforcement or protection if the device is physically accessed by an unauthorized party.

Encryption and a corporate policy address data storage and acceptable use but omit the access control layer - a password or PIN - that prevents an unauthorized person from unlocking and actively using the device.

Encrypting the non-volatile memory ensures all stored data is cryptographically protected if the device is lost or stolen, while requiring a password or PIN enforces access control that prevents unauthorized users from unlocking the device - together these two technical controls address both unauthorized access and data exposure without relying on user policy compliance.

A password or PIN combined with a policy addresses access control and usage guidelines but leaves stored data unencrypted, meaning it can be recovered by forensic tools if the device is seized or compromised.