When mobile equipment is used, at least the following are in place: the device is patched and hardened under management; a mobile device management or mobile application management solution is used; and users sign a mobile working agreement acknowledging the risks of mobile working and declaring they will work safely, which applies to every mobile device the employee uses for business. Compliance with all three is checked periodically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.