I’ve been privy to how a few of these highly regulated organisations are handling WFH, and the main challenges they seem to face are compute/network capacity on

I’ve been privy to how a few of these highly regulated organisations are handling WFH, and the main challenges they seem to face are compute/network capacity on their virtual desktop/VPN/conferencing/instant messaging infrastructure. Which usually tend to be hosted on site. Of course people could bypass the systems completely, by say getting a private slack for their team. But doing so would (usually) be a policy violation, and from a compliance perspective, policy is often a valid control. Not all regulations require technical controls, and if they do, there’s often room to make exceptions to implement alternative controls when circumstances require it.