Mechanisms exist to appropriately protect devices that capture sensitive/regulated data via direct physical interaction from tampering and substitution.
Does the organization appropriately protect devices that capture sensitive/regulated data via direct physical interaction from tampering and substitution?