ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The primary goal of personal-device restrictions is to eliminate opportunities for covert recording, data exfiltration, or the introduction of malicious code. The most effective way to achieve this in a high-sensitivity space is to prohibit personal electronic devices from the area and provide secure storage so work can proceed with vetted, company-managed equipment. Mobile-device management on personal phones still leaves cameras and local storage available, S3 network controls only address data leaving via the network (not photos taken offline), and NDAs or additional cameras serve as deterrent or detective controls but do not prevent the presence or use of unauthorized devices. Therefore, enforcing a policy that requires all personal devices to be stored outside the lab while supplying approved loaner systems best satisfies (ISC)² recommendations for personal device restrictions.