A CIO just received a final audit report that indicates there is inconsistent enforcement of the enterprise's mobile device acceptable use policy throughout all business units. Which of the following should be the FIRST step to address this issue?

A. Review the relevance of existing policy.
B. Implement controls to enforce the policy.
C. Mandate awareness training for all mobile device users.
D. Incorporate compliance metrics into performance goals.