An organization is in the process of deciding whether to allow a bring your own device (BYOD) program. If approved, which of the following should be the FIRST control required before implementation?

A. Device baseline configurations
B. Device registration
C. An acceptable use policy
D. An awareness program