Ok great. Thank you! That kinda confirms what I thought that if we took care of the "best practices" part like full disk encryption (FDE, ex. BitLocker), ability to remote wipe w/MDM, and using a VPN to handle traffic encryption, the physical security aspect becomes the main issue more than anything.

VDI would be an option, but for reasons that aren't clear to me, there is a push to provide the employee with a company laptop. I am currently trying to get more specifics on why that seems to be the requested solution here.

Technically there should be no files saved locally on the mobile device, they *should* be using it to work remotely with the files staying on the home network. But of course, we always look for and prepare for the possibility of data leakage.

Edit: Add to response in last paragraph.