An IS auditor finds that corporate mobile devices used by employees have varying levels of password settings. Which of the following would be the BEST recommendation? 

Answer options:

A. Update the acceptable use policy for mobile devices.
B. Notify employees to set passwords to a specified length.
C. Encrypt data between corporate gateway and devices.
D. Apply a security policy to the mobile devices.

D