Where BYOD devices are connected to guest or public facing networks, they must not be given access to the corporate network by any route other than a VPN across the Internet.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.