The first line of defence is firewall protection and packet filtering preceding the reception zone.
Tenant-occupied facilities should include a reception zone within the institution's premises, capable of being staffed at all times.