Locked cabinets, clean-desk policy, visitor logs, disposal of source docs, and shredding requirements.