In the absence of technical controls, the best way to reduce unauthorized text messaging is to include the topic of prohibited texting in security awareness training. CISM recognizes that when automated or technical enforcement is unavailable, user behavior must be influenced through targeted awareness and training.
Training is stronger than simple reminders because it can explain the policy requirement, business rationale, examples of prohibited behavior, consequences of noncompliance, and proper alternatives. Regular reminders of the acceptable use policy may help reinforce expectations, but they are less effective than structured training. Stopping mobile device use would likely disrupt business and may not be proportionate to the risk.
Conducting a BIA is unrelated because the issue is user behavior and policy compliance, not continuity prioritization. CISM emphasizes that awareness and training programs should be tailored to specific roles, technologies, and behaviors. Therefore, incorporating prohibited texting into security awareness training is the best compensating measure when technical controls are not available.
References:
ISACA CISM Review Manual, Information Security Program Development and Management - security awareness and acceptable use ISACA CISM Exam Content Outline, Domain 3: Information Security Program Development and Management