Physical Security Controls: Servers and workstations managing sensitive information, as well as related electronic storage media (such as USB drives, memory sticks, disks, backup tapes, CD ROMS and other removable media), must be located in a secured area to which only authorized individuals have access. 6.