What security requirement is specified for facilities?

• A. Must have a password policy only
• B. Security is optional
• C. Must have a physical barrier or alarm system approved by the board, and any changes must be approved in advance
• D. No security requirements specified

Answer: (C)

Security for facilities hinges on tangible protections and clear governance. A password policy addresses only digital access and leaves the physical space vulnerable to entry or tampering. If security were optional or not specified, there would be no guaranteed protections for people, assets, or information in the facility. Requiring a physical barrier or alarm system approved by the board, with any changes needing advance approval, creates a formal, accountable framework. The barrier or alarm provides immediate protection and detection, while board-approved changes ensure security measures remain aligned with risk assessments, budgets, and organizational policies. This combination embodies a responsible, oversight-driven approach to safeguarding facilities.