Which of the following statements is true regarding a bring-your-own-device (BYOD) environment?

In a bring-your-own-device (BYOD) environment, an organization has inherently less technical control over the hardware and software on an employee's personal device compared to a corporate-owned device. This control gap elevates the importance of administrative controls. The organization's security posture becomes heavily dependent on the user's diligence in following security policies, such as maintaining device security, reporting loss or theft promptly, and adhering to acceptable use standards. Therefore, relying on user compliance is a critical and heightened necessity for mitigating the risks associated with BYOD.

B. The increased complexity and unique risks of BYOD (e.g., data commingling, legal issues) demand more robust and detailed documented policies, not fewer.
C. Incident response is more critical and often more complex in a BYOD environment due to the increased risk of data loss on unmanaged personal devices.
D. The organization ultimately retains the primary operational, legal, and reputational risk for its data. While employees assume device ownership costs, the organization's risk exposure increases.

1. ISACA. (2013). COBIT 5 for Information Security. In the discussion of management practices for information security, particularly under domain DSS05 Manage Security Services, the guide emphasizes the need for security awareness training and communication of policies to end-users. For personal devices, where technical controls are limited, this reliance on user awareness and policy compliance (an administrative control) becomes paramount. (See specifically DSS05.02, "Protect against malicious software," and its relation to end-user devices).

2. Morrow, B. (2012). BYOD Security: A SANS Whitepaper. SANS Institute InfoSec Reading Room. This paper states, "The most important part of a BYOD program is the policy... Users must be trained on the policy and agree to it before being allowed to participate." This highlights the foundational reliance on policy and user agreement, which is central to the correct answer. (Page 4, Section: "BYOD Policy").

3. Afshan, G., & Goudar, R. H. (2016). A Framework for Secure Bring Your Own Device (BYOD) Implementation in an Organization. Perspectives in Science, 8, 422-424. The authors note that "User awareness is the most important factor for the success of BYOD... The organization must rely on the user to follow the security policies." This academic source directly supports the conclusion that reliance on user compliance is greater in a BYOD model. (Page 423, Section 3.2 "User Awareness"). https://doi.org/10.1016/j.pisc.2016.04.095