What it asks for. Design and apply security measures for working in secure areas.
In practice. People are told about the existence of a secure area and what goes on there only when they need to know. Unsupervised work in secure areas is avoided where practical, vacant secure areas are locked and checked, and photographic, video, audio and other recording devices are restricted unless authorised. Visitors and contractors are escorted. Rules are posted and included in briefings for those with access. Auditors look for documented rules, access logs, escort records and evidence of periodic inspection.
Common gaps. Rules exist on paper but staff routinely bring phones and other recording devices into sensitive areas without challenge. Maintenance contractors are often left unsupervised for convenience, and nobody checks rooms after hours.