Physical access to information processing and storage areas and their supporting infrastructure must be controlled to prevent, detect and minimize the effects of unintended access to these areas (e.g., unauthorized information access). Access control is established by imposing standards for protection at the building, processing area and supporting infrastructure areas. The level of control imposed on these areas will reflect the nature of the importance of the information handled or supported by the area to corporate operations. 

This work program sample can be used to perform an audit of the physical security of your IT facilities.