Physical security is required and is often ignore and/or too weak. McCreight and Leece (2016) make the following six recommendations addressing security controls in an environment of IT and physical security convergence.

1. Document physical security configuration
2. Follow a planned maintenance procedure
3. Use standards based technology
4. Maintain and measure vendor supply chain
5. Consider data within physical security infrastructure as sensitive enterprise data
6. Follow vendors best practices.

Do you agree with these recommendations? Why or why not? How do these recommendations support a formal asset classification and risk assessment process?