An IT strategy committee has reviewed an audit report indicating sales employees are using personal smartphones to conduct corporate business. Although the committee appreciates the business benefits,

Documenting procedures is important, but without prior training, employees may not understand or follow them effectively, making it a secondary step to immediate risk mitigation.

Improving training courses on securing corporate information directly addresses the immediate human factor of risk by educating employees on safe practices when using personal devices for business. This proactive measure ensures that employees understand how to protect sensitive corporate data immediately, given they are already using these devices.

Performing a risk assessment is a foundational step for understanding risks, but it doesn't immediately mitigate the ongoing security risk from current user behavior.

Updating the corporate security policy is essential for formalizing rules, but without training, it may not immediately change employee behavior or secure existing usage effectively.