The security measures should apply just enough controls to cover threats while enforcing policies and procedures specific to the information asset. Physical security measures can cover people, situations, or both, but costs and tradeoffs are involved. The first step in developing security measures are to conduct a security survey, based on a division of the computer facility into compartments. Controls should be increased over the compartments with the most valuable contents. Specific measures include limiting the numbers of entrances and exits to computer centers, using a receptionist or security officer at public access entrances, issuing visitor passes, and checking materials carried in and out of the facility. It is also useful to locate the computer facility close to utility connections and within reach of fire protection. Low-rise computer buildings should be unmarked and located apart from the main building. Electronic access controls such as card keys and keypads are particularly useful. Security professionals should also be aware that protecting the information is even more valuable than protecting the equipment. They should try to balance production and the free flow of information with security and its inconvenience. Addresses of sources of further information.