1. Lock areas containing systems.
  2. Grant physical access only to authorized staff.
  3. Remove access when roles change.