VPN access is consistently provisioned, reviewed and removed when no longer required
Granting VPN access only on approval and removing it the day someone leaves is A.5.18's provisioning and revocation requirement applied to remote network access specifically.
This process control provisions VPN access only on approval and removes it promptly when no longer needed, the lifecycle discipline A.6.7 expects of remote access.