The organization plans to roll out multifactor authentication to 20,000 employees in several countries, and leadership is concerned about disruption to daily operations. Which approach BEST reduces that risk?

A phased rollout introduces the control in stages, beginning with a representative pilot group, so problems with enrollment, devices, applications, travel scenarios and support processes are found and fixed while their impact is small. Lessons are then applied before expanding by region or business unit, which protects operations while still reaching full coverage on a planned timeline. Enabling multifactor authentication for every user on the same weekend concentrates all risk at one moment; any unforeseen issue would affect 20,000 people simultaneously across time zones and overwhelm support. Deploying only to IT staff limits disruption by avoiding most of the workforce, but it leaves business users, who are frequent phishing targets, protected only by passwords and so fails the control objective. Letting each employee choose when to enroll over a year removes management control of coverage, leaves many accounts unprotected for an extended period and makes support demand unpredictable. Exam caveat: implementation planning in CISM balances risk reduction against business disruption and includes communication, training and support readiness alongside the technical deployment. Operational check: define pilot success criteria such as enrollment rate, help desk tickets per user and failed authentications, and require them to be met before each next phase begins.