What it asks for. Because email and browsers are where users meet most threats, this control asks organisations to harden and filter them. It covers supported browsers and mail clients, filtering of malicious content and domain protections against spoofing.
In practice. Good practice keeps browsers and email clients on supported, centrally managed versions with limited, approved extensions. DNS and web filtering block known malicious and unwanted categories, email gateways scan attachments and links, and SPF, DKIM and DMARC are configured with an enforcing DMARC policy. Evidence includes browser management policies, filtering configurations, DMARC reports and statistics on blocked messages and sites.
Common gaps. DMARC is often left at a monitoring policy indefinitely, and browser extensions are rarely controlled. Filtering may not follow remote users who work outside the corporate network.