Sara, the Chief Information Officer (CIO), has tasked the IT department with redesigning the network to rely less on perimeter firewalls, to implement a standard operating environment for client…

Malicious internal attacks are addressed by other controls such as access monitoring; the described measures - device standardization and banning personal devices - are more targeted at data pathway control than internal threat detection.

Data exfiltration is the greatest concern because personally managed and uncontrolled devices can bypass corporate data governance controls, allowing sensitive information to be copied, transmitted, or leaked externally. The shift away from perimeter-only security toward endpoint standardization directly addresses the risk of data leaving through unmanaged, untrusted devices.

Audit findings represent a compliance outcome rather than a security risk that would motivate a fundamental network architecture redesign.

Incident response is a reactive process and does not drive the proactive architectural decisions described, which focus on preventing data exposure before an incident occurs.