Health and Human Services - Security Standards: Physical Safeguards
This link provides a sample policy checklist designed to examine compliance with Federal regulations that have not changed since that time. This standard speaks to EPHI data, but it can be adapted to other regulated data like CUI (see Section 4 – Maintenance Records).