A Chief Executive Officer (CEO) suspects someone in the lab testing environment is stealing confidential information after working hours when no one else is around. Which of the following actions…

Implementing time-of-day restrictions typically applies to logical system access, not physical entry, and would not prevent an already physically present individual from accessing systems or data after hours if they are physically in the lab.

Auditing file access times is a detective control that identifies when files were accessed, but it does not prevent the initial unauthorized access or theft of information.

Secretly installing a hidden surveillance camera is a detective control that can record events but does not physically prevent the act of stealing information, and may have legal and privacy implications.

Requiring swipe-card access to enter the lab is a physical security control that restricts entry to authorized personnel during specific times or periods. This directly prevents an unauthorized person, even an employee, from physically entering the lab after working hours when no one else is around to steal information.