When determining the level of physical controls required for a workstation, the most critical factor is its value to the business. Physical controls are security measures implemented to protect assets from unauthorized access, damage, or theft.

Asset Value → Determines the level of protection required.

Risk Assessment → Identifies threats like theft, sabotage, or natural disasters.

Compliance Requirements → Ensures alignment with security regulations and best practices.

(A) Ease of use.

Incorrect: While user-friendliness is important, security measures are primarily based on asset value and risk, not convenience.

IIA Standard 2110 (Governance) emphasizes security over ease of use.

(B) Value to the business. (Correct Answer)

The higher the workstation's importance to business operations, the stronger the physical controls required.

Workstations handling sensitive data or critical systems require additional security.

COSO ERM – Risk Assessment requires evaluating asset value when designing security controls.

(C) Intrusion prevention.

Partially correct but secondary: Intrusion prevention is one of many security concerns, but the primary driver for determining physical controls is the asset’s business value.

(D) Ergonomic model.

Incorrect: Ergonomics is about user comfort and efficiency, not security.

IIA Standard 2120 – Risk Management: Requires risk-based decision-making, including evaluating asset value.

GTAG 9 – Identity and Access Management: Stresses that security measures must align with asset value and business risk.

COSO ERM – Risk Assessment: Establishes asset value as a key determinant in risk-based security controls.

Factors Considered in Physical Security Decisions:Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because the level of physical controls should be determined based on how critical the workstation is to business operations.