Physical security measures must be dimensioned according to risk assessments. These assessments must consider factors such as the need-to-know principle, segregation of duties, and the principle of least privilege in processes related to access control and other security arrangements. Risk assessments of physical security measures must be conducted regularly and integrated into the organization's overall risk management framework. Each identified risk must have an assigned owner.

The assessment must take into account all relevant factors, particularly:

• the security classification and legal basis for confidentiality of the information;
• the method and volume of information processing and storage, noting that large quantities of information or the consolidation of data may require stricter risk management measures;
• the duration of information processing and storage;
• the environment of the processing and storage location, including the surrounding area of the building, its placement within the building, or within specific premises;
• response times in alarm situations;
• outsourced functions such as maintenance, cleaning, property management, and security services;
• and the estimated threat posed to the information by intelligence services, criminal activities, or the organization's own personnel.