S3.3.5 - maintaining and enforcing physical security