Every analyst device is hardened with disk encryption, endpoint detection, and enforced MFA before it can reach a client network. We layer ZTNA or VPN with conditional access so connections are verified by user, device, and posture, not just a password. When someone leaves, we revoke access immediately across all systems to close the offboarding gap auditors flag most.