The device should be physically protected. This means it should be located in special room (server room) in which access will have only authorized personnel. \
Second thing is to use password protection. With password protection everyone who wants to configure the CISCO device will have to authorize him/herself.