No way they could ever pass an ITAR or SOC 2 audit with employees using their own machines. Data security is critical part of these governmental frameworks and

No way they could ever pass an ITAR or SOC 2 audit with employees using their own machines. Data security is critical part of these governmental frameworks and having a set of controls in place that companies must comply with if they are to be certified. Keeping ITAR data on an employee's personal PC that is open to the internet is probably one of the biggest no-no's I can envision.