Which of the following is the BEST way to mitigate risk to an organization's network associated with devices permitted under a bring your own device (BYOD) policy?

A Network Access Control (NAC) system is the most comprehensive solution for BYOD risk mitigation because it can dynamically assess the security posture of personal devices (e.g., antivirus status, patch level, encryption) before granting or restricting network access. NAC enforces policies, isolates non-compliant devices, and provides granular control over what resources BYOD devices can access, significantly reducing the attack surface.

Requiring devices to be reviewed by IT staff is often impractical for large organizations and provides only a point-in-time check, not continuous enforcement.

Enabling port security on network switches primarily limits the number of MAC addresses per port and restricts unauthorized devices from plugging in, but doesn't address the security posture of authorized wireless BYOD devices or their software.

Requiring antivirus software is an important security control but is only one component of a holistic security posture; NAC can enforce this and many other requirements.