The ECB and the NCAs shall each define and implement authorisation rules and physical protection measures governing their staff's access to any physical area, without prejudice to Article 4 of this Guideline.