The decision on which forms of remote access to permit follows from the organisation's overall security policy; where a form cannot be secured as that policy requires, for example because it cannot use approved cryptography to protect sensitive data, it is not permitted. The overall security policy takes priority when the telework policy is written.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.