Implement a clean desk policy and lock unattended screens automatically

A physical intruder who reaches an unlocked workstation has the same access as the authenticated user who left it. During Kevin Mitnick's penetration operations, unlocked terminals, discarded printouts, and papers left on desks were as valuable as any technical exploit. Implement: automatic screen lock after 5 minutes of inactivity (enforce via Group Policy/MDM), required badge-out to lock desks when leaving them, a prohibition on leaving sensitive documents visible on desks, and locked cabinets for paper records. Clean desk audits — periodic unannounced checks of workstation and desk areas — measure compliance without being punitive.