What it asks for. Point (j) requires, where appropriate, the use of multi-factor or continuous authentication solutions, secured voice, video and text communications, and secured emergency communication systems within the entity.
In practice. Multi-factor authentication is enforced for remote access, administrators, email and critical applications, preferably with phishing resistant methods for high risk users. Internal communications use encrypted, managed tools, and an out of band emergency communication channel exists for use when primary systems are compromised. Evidence includes MFA coverage reports, communication tool configurations and tested emergency communication procedures.
Common gaps. MFA exceptions for legacy systems and service accounts are common. Few entities have tested how they will communicate if email and chat are unavailable during a crisis.