A user reports a stolen personal mobile device that stores sensitive corporate data. Which of the following will BEST minimize the risk of data exposure?

Remotely wiping the device immediately deletes all data, including sensitive corporate information, from the stolen mobile device. This action directly prevents unauthorized access to and exposure of the data, making it the most effective immediate control.

Removing user access to corporate data prevents future access but does not protect the data already stored on the stolen device.

Preventing personal mobile device use is a policy decision for the future, not an immediate action to mitigate data exposure from a currently stolen device.

Reporting the incident to the police is a necessary legal and procedural step, but it does not directly mitigate the risk of data exposure from the device itself.