Management implements physical access controls for the infrastructure and the locations housing it: a maintained list of individuals authorised for physical access, validation of authorisation before access to data centres, computer rooms and sensitive areas, credentials for personnel and visitor badges for third parties, maintained and reviewed access logs, monitored intrusion alarms and surveillance, escorted and monitored visitors, secured keys and combinations changed on compromise, loss, transfer or termination with electronic credentials removed promptly, regular review of the inventory of access devices and of the access lists, and alternative access processes for when electronic controls fail.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.