VPN CMMC Compliant?

What is CMMC compliant regarding a VPN? Does it need to have MFA? End to End Encryption is probably a given but which VPN is sufficient? Can it be a COTS VPN?