Map how employees reach business systems
Separate applications accessed through a browser from those that require a private network connection. Note which devices are company-owned and which are personal. An access review should consider the user, device and information involved together, rather than assuming every remote worker needs the same connection method.