physical-security Controls

Sanitize or destroy media containing FCI before disposal or reuse

Limit physical access to systems and facilities to authorized individuals

Escort visitors and monitor visitor activity in secured areas

Maintain audit logs of physical access to secured areas

Control and manage physical access devices

Implement policies and procedures to limit physical access to electronic information systems and the facilities where they are housed

Specify the proper functions to be performed by workstations that access ePHI and the manner in which those functions are to be performed

Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users

The physical environment is monitored to detect potential cybersecurity events

Physical access to assets is managed, monitored, and enforced commensurate with risk

Technology assets are protected from environmental threats