Deployment coverage and configuration assurance, as above: a documented, consistent control at the network edge, with records of what is deployed and how it is configured, plus monthly security reports.

That is usually the gap in a remote working control set, because it is the one thing most organizations can describe as a policy but not evidence as a control.