Physical controls are security measures designed to deter or prevent unauthorized physical access to sensitive assets, such as facilities, equipment, and resources containing personal data. Keypad or biometric access systems are quintessential examples of physical controls. They restrict entry to secure locations like data centers or server rooms, thereby physically protecting the information systems and paper records stored within. By preventing unauthorized individuals from gaining physical proximity to the data, these controls directly limit the risk of theft, damage, or unauthorized viewing, which are significant privacy risks.

B. user access reviews: This is an administrative control, a procedural measure focused on ensuring that logical access rights remain appropriate over time.
C. Encryption: This is a technical (or logical) control that protects the data itself by rendering it unreadable without the proper decryption key.
D. Tokenization: This is a technical (or logical) control that replaces sensitive data with a non-sensitive equivalent, protecting the original data at a logical level.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

"Security and Privacy Controls for Information Systems and Organizations."

Reference: Control Family: Physical and Environmental Protection (PE)

Control: PE-3 Physical Access Control.

Details: This control specifies measures to manage physical access to systems. The discussion section explicitly lists "electronic access control devices (e.g.

keypads

card readers

biometric devices)" as mechanisms to enforce physical access authorizations.

2. Densmore

R. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP (International Association of Privacy Professionals).

Reference: Chapter 5

"The Privacy Operational Life Cycle: Protect

" Section on "Security Controls."

Details: The official IAPP CIPM textbook categorizes controls into administrative

physical

and technical. It defines physical controls as those that "protect the environment where data and systems are housed" and provides examples such as "locks on doors

security guards

and surveillance cameras

" which are in the same category as keypad and biometric access systems.

3. Purdue University

"Information Security Policy (VII.B.2)."

Reference: Section 4

"Definitions."

Details: The university's information security policy defines the three classes of controls. It defines Physical Controls as mechanisms "to protect the IT environment

" providing examples like "locked doors

security guards

and biometric access control systems." This aligns with the correct answer.