Limit physical access to systems and the environments in which they operate.
Physical protection asks who can walk up to the systems that hold CUI, how visitors are escorted and logged, how physical access devices are controlled, and how alternate work sites are safeguarded. Four of its six requirements are Level 1 practices.