The customer support department within a large organization purchased mobile devices for all 150 remote technicians to improve efficiency. In addition, a new Help Desk application will be developed that works with the mobile devices. The IT department manager attempted to stop the deployment because the equipment and application are non-standard and unsupported within the organization. However,

upper management decided to continue the deployment. Which of the following provides the BEST method for evaluating the potential threats?

A. Conduct a vulnerability assessment for the new devices and the application.
B. Deploy a small portion of the mobile devices to obtain a benchmark on how the devices will affect the organization.
C. Perform a risk assessment for the new devices and the application, and classify the risk associated with the full lifecycle of the hardware and software deployment.
D. Develop a standard image for the new devices, and migrate to a web application to eliminate locally resident data.

C
Explanation: You should perform a risk assessment for the new devices and the application, and classify the risk associated with the full lifecycle of the hardware and software deployment. This option will identify and analyze potential threats for the mobile device deployment.
You should not conduct a vulnerability assessment because a risk assessment is more comprehensive.
You should not deploy a small portion of the mobile devices to obtain a benchmark on how the devices will affect the organization. While this would allow you to test the impact of the devices on the network, this would not help you to evaluate potential threats.
You should not develop a standard image for the new devices and migrate to a web application to eliminate locally resident data. This solutions does not evaluate potential threats.