If insufficient site access controls have been implemented, unauthorised persons may enter an office room and extract sensitive data or steal or manipulate devices. This may affect the availability, confidentiality, or integrity of devices and information. Even when no immediate damage is apparent, operations can still be disrupted. It is thus necessary to examine how such an event was possible, whether or not damage occurred, and whether data or devices were manipulated.