Which approach for managing end-user device security is typically used for lost or stolen company- owned devices?

Mobile Device Management (MDM) is the correct approach as it provides organizations with granular, centralized control over the entire lifecycle of company-owned devices. For a lost or stolen device, MDM is the essential tool that enables administrators to execute critical security functions remotely. These include locating the device, enforcing a lock, or initiating a full data wipe (factory reset) to prevent sensitive corporate data from being compromised. This comprehensive device-level control is the primary method for mitigating the risks associated with physical device loss.

A. Mobile Application Management (MAM): MAM secures data within specific corporate applications, not the entire device. It cannot perform a full device wipe, making it insufficient for a lost company-owned asset.

B. Data Loss Prevention (DLP): DLP is a broader strategy to prevent data exfiltration. While a component of security, it is not the management system used to remotely lock or wipe a lost device.

C. Bring Your Own Device (BYOD) policy: This is an administrative policy governing the use of personal devices for work, which is irrelevant to the management of lost company-owned devices.

References:

1. Shared Assessments CTPRP Body of Knowledge: The CTPRP curriculum covers Domain 5: Security & Risk Management, which details controls for endpoint security. It specifies that enterprise mobility management solutions, primarily MDM, are the standard for enforcing policies on corporate-owned assets, including the critical control of remote wipe capability for lost or stolen devices. (Reference: CTPRP Body of Knowledge, Domain 5, Endpoint Security Controls).

2. NIST Special Publication 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise: This foundational document explicitly recommends MDM for securing corporate devices. Section 3.2, "Centralized Management," states, "An MDM can remotely lock or wipe a lost or stolen device to prevent unauthorized access to sensitive data." This directly supports MDM as the primary tool for this scenario.

3. Morrow, D. (2012). BYOD, MDM, and the Future of Enterprise Mobility. Information Systems Security, 21(4), 206-210. This academic article distinguishes between different mobility management strategies, clarifying that MDM is focused on device-level security and control, including "remote wipe of lost or stolen devices," which is essential for corporate-owned assets. (DOI: https://doi.org/10.1080/1065898X.2012.713589, Page 207).

1. NIST Special Publication 800-124 Revision 2, “Guidelines for Managing the Security of Mobile Devices in the Enterprise,” §3.3.2, pp. 27-28 – remote wipe for lost/stolen devices.

2. ISO/IEC 27002:2022, control 8.1.4 – “Protecting equipment off-premises,” recommending remote disable/wipe for lost assets.

3. MIT OpenCourseWare, “Mobile and Wireless Security,” Lecture 9 slides, p. 14 – notes remote wipe as primary response to lost corporate devices.