An IS auditor finds that corporate mobile devices used by employees have varying levels of password settings. Which of the following would be the BEST recommendation?

A. Update the acceptable use policy for mobile devices.
B. Notify employees to set passwords to a specified length.
C. Encrypt data between corporate gateway and devices.
D. Apply a security policy to the mobile devices.