• Secure endpoints and mobile devices (use MDM/EMM solutions).
• Restrict USB access where not needed.
• Monitor for physical intrusion attempts or tampering.