What it asks for. Design and apply physical security for offices, rooms and facilities so that they are protected appropriately.
In practice. Sensitive areas are located away from public access, are not signposted in ways that reveal their purpose, and have controlled entry. Windows, doors and shared spaces are considered, as are directories and floor plans that could help an intruder. Measures scale with risk, so a server room or records store gets stronger protection than a general meeting room. Evidence includes a physical security assessment, site plans showing zones, access control configuration and records of periodic checks.
Common gaps. Shared or leased buildings are often assumed to be secured by the landlord without any verification. Small rooms holding network equipment or archives are frequently overlooked and left unlocked.