A facility physical security program shall use a layered security or defense-in-depth approach consisting of the following criteria:

1. Perimeter protection is the first line of defense in providing physical security for
personnel, property, and information at a facility.
2. Interior controls, as the second line of defense, are perhaps the most important. The extent of interior controls will be determined by considering the local threat environment and criticality of the items and areas to be protected, the vulnerability of the facility, monetary value, and the cost of the controls necessary to reduce that vulnerability.