It wasn’t a requirement. They have a VPN server for remote access. The network scan found it and complained even though it’s not related.