Because the network is assumed compromised, security controls must follow the data regardless of its location or the access method being used.