(b) The Office shall establish administrative and physical controls to prevent unauthorized access to its systems of records, to prevent the unauthorized disclosure of records, and to prevent the unauthorized disclosure of records, and to prevent the physical damage or destruction of records. The stringency of such controls shall reflect the sensitivity of the records the controls protect. At a minimum, however, the Office's administrative and physical controls shall ensure that—

1. (1) Records are protected from public view,
2. (2) The area in which records are kept is supervised during business hours to prevent unauthorized persons from having access to the records, and
3. (3) Records are inaccessible to unauthorized persons outside of business hours.