GAO/AIMD00295, September 6, 2000) showed that in 24 agencies, physical and logical access controls were not effective in preventing or detecting system intrusions or misuse.
For some of the agencies, the physical access controls were ineffective because they were outdated.