Senior management wants to provide mobile devices to its sales force. Which of the following should the information security manager do FIRST to support this objective?

A. Assess risks introduced by the technology.
B. Develop an acceptable use policy.
C. Conduct a vulnerability assessment on the devices.
D. Research mobile device management (MDM) solutions.