The greatest inherent risk in IoT adoption is the potential for vulnerabilities within device software and connectivity. The best way to reduce this risk is to implement secure-by-design and secure-coding practices from the outset.
CRISC guidance:
"For emerging technologies such as IoT, risk mitigation begins with embedding secure design, coding, and configuration practices throughout the development lifecycle." Pilot testing is beneficial but occurs later; secure design is foundational.
Hence, A is correct.
CRISC Reference: Domain 3 - Risk Response and Mitigation, Topic: Secure System Development and Emerging Technologies.