Carlos is the Information Technology (IT) administrator for a small company. Over the past year, employees have been using their personal mobile devices and smartphones for business use. This has reduced costs of purchasing new devices for employees. Carlos is now considering whether he should stop supplying employees with company phones and instead require all employees to use their personal smartphones for work. How can Carlos address the most significant security vulnerability?