If you're a government agency or anyone for whom a security failure costs more than sending an apology letter, you should really have your equipment in a locked rack, if not on prem.