The organisation determines and documents the alternate work sites employees may use, applies defined controls there, assesses the effectiveness of those controls, and gives employees a way to reach security and privacy personnel about incidents. No enhancements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.