13.3.2. For that purpose, the relevant entities shall: (a) on the basis of the risk assessment …

(a)

on the basis of the risk assessment carried out pursuant to point 2.1, lay down and use security perimeters to protect areas where network and information systems and other associated assets are located;

(b)

protect the areas referred to in point (a) by appropriate entry controls and access points;

(c)

design and implement physical security for offices, rooms and facilities,

(d)

continuously monitor their premises for unauthorised physical access.