One of the key things that often is missed is a well-documented control process. It's important to know who has access to what, from where and when. Who has the keys to get into the office, and how can they remotely access the data?