A business case indicates an enterprise would reduce costs by implementing a bring your own device (BYOD) program allowing employees to use personal devices for email. Which of the following should…

Assessing enterprise architecture might be part of the technical planning, but risk assessment precedes it as a governance priority.

Updating the network infrastructure is an implementation step, which should follow a thorough risk assessment and policy definition.

Updating the BYOD policy is a crucial step, but it must be informed by a prior assessment of the specific risks the policy needs to address and mitigate.

Before adopting a BYOD program, particularly one involving access to corporate email on personal devices, assessing the BYOD risk is the essential first governance action. This assessment identifies potential security vulnerabilities, data privacy concerns, compliance issues, and operational impacts that must be understood and mitigated before proceeding with policy updates or infrastructure changes.