The following statements reflect user obligations defined in end-user device policies EXCEPT:

End-user device policies outline the specific responsibilities and obligations of the individual user to protect company data and assets. These obligations typically include actions like reporting lost or stolen devices, using strong authentication, and installing only authorized software. A statement describing a centralized, infrastructure-level security task, such as configuring network firewalls or applying server-side patches, would be the responsibility of the IT or security department, not the end-user. Therefore, such a statement would be the exception in a user-focused policy.

(Hypothetical Option A: Users must report a lost or stolen device immediately.) This is a standard and critical user obligation found in virtually all end-user device policies to enable prompt incident response.

(Hypothetical Option B: Users must not install unauthorized or unlicensed software.) This is a core user obligation to prevent malware, security vulnerabilities, and licensing violations on company devices.

(Hypothetical Option C: Users must enable a password-protected screen lock.) This is a fundamental user-controlled security measure to prevent unauthorized physical access to a device and is a common policy requirement.

1. Shared Assessments Program, Standardized Information Gathering (SIG) Questionnaire. The "End User Device Security" domain contains specific questions (controls) that verify policies are in place requiring users to protect their devices, confirming these are standard user obligations.

2. NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. Control family AT (Awareness and Training) and PS (Personnel Security) cover the requirements for communicating user responsibilities regarding system and data protection.