Explanation
The best recommendation to mitigate the risk of data leakage from lost or stolen devices that contain confidential data is to configure them to auto-wipe after multiple failed access attempts, as this would prevent unauthorized access and erase sensitive information from the device. Requiring employees to attend security awareness training, password protecting critical data files, or enabling device auto-lock function are also good practices, but they may not be sufficient or effective in preventing data leakage from lost or stolen devices.
References: CISA Review Manual (Digital Version), Chapter 5, Section 5.3