Which statement best describes mobile device protection for CUI?

• A. Encrypt, remote wipe, device controls, and limit CUI storage on mobile devices.
• B. Use multi-factor authentication on mobile devices only, without encryption.
• C. Do not store any CUI on mobile devices.
• D. Rely on corporate network security and do not manage devices.

Answer: (B)

Protecting CUI on mobile devices centers on controlling who can access data from those devices. Multi-factor authentication on mobile devices adds a strong barrier that prevents unauthorized access even if credentials are compromised or the device is lost. By requiring a second form of verification—something the user has or a biometric factor in addition to a password—the risk of someone’s stolen credentials yielding access is greatly reduced. Although encryption and other controls are important parts of a complete protection strategy, the option that emphasizes MFA on mobile devices captures the essential protection of ensuring that only properly authenticated users can reach CUI on portable endpoints. In practice, a robust approach would also include encryption and device management, but MFA is the most critical protective gate for mobile access among the choices.