Network blocking
Hosts on "minimum security" networks
Best practice - Networks Remote Access
Policy on use of "NAT" protocols?