The Chief Executive Officer (CEO) of a corporation purchased the latest mobile device and wants to connect it to the internal network. The Chief Information Security Officer (CISO) was told to…

Mitigate involves implementing security controls such as MDM, containerization, or device enrollment policies to reduce the risk posed by the unmanaged mobile device. Transfer shifts the residual risk to a third party, such as through cyber insurance. Together these two strategies address the risk without blocking the CEO's required access.

Accept means acknowledging the risk without taking action to reduce it, which is inappropriate when technical controls can and should be applied to a high-profile executive device.

Transfer alone is insufficient without mitigation controls, and Avoid means eliminating the activity entirely, which directly contradicts the CEO's stated requirement for access.

Avoid is not viable because the CEO has mandated the access, making it impossible to eliminate the risk by refusing the connection.