We recommend that Millennium Challenge Corporation's Chief Information Officer document and implement a written physical and environmental protection policy that includes all security controls required by National Institute of Standards and Technology Special Publication 800-53, Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations," and reflects the current operating environment.