Which of the following is the BEST preventive control to protect the confidentiality of data on a corporate smartphone in the event it is lost?

Encryption protects data confidentiality by scrambling the information on the device, making it unreadable without the correct decryption key. In the event of device loss, this prevents unauthorized access to the sensitive data, even if the device's physical security or authentication mechanisms are bypassed.

A remote data wipe program is a reactive control designed to erase data *after* a loss is detected, rather than a preventive measure that protects data confidentiality *at the time of loss*.

A password for device authentication prevents unauthorized access to the device, but if the device's storage is physically removed or the password is bypassed, the data itself remains unprotected.

Biometric authentication, like a password, controls access to the device itself but does not inherently protect the underlying data if the storage is accessed bypassing the authentication mechanism.