Which of these is not a good practice for physical security?

Access to sensitive equipment and data is controlled $--$ that includes access to printers, fax machines, computers, and paper files.

Unattended areas are kept secure with door locks and other devices whenever possible, even during business hours.

Door locks, alarms, and other physical security devices are used to keep areas secure when not open for business.

To preserve good customer relations, visitors are generally allowed access to all areas of a facility unless it appears they are doing something suspicious.