"At the most basic level, physical access to information assets, such as servers, may be restricted." . . . .