The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards.