access to areas where confidential information is processed or stored should be
restricted to authorized individuals only
by implementing appropriate access controls, e.g. by implementing a
two-factor authentication mechanism such as an access card and secret PIN;