Re: "Compass is not a publicly accessible system"
Publicly accessible in IT terms means the system can be interacted with by any member of the public. Whether the interaction requires a login to proceed further is irrelevant in this regard. The system is publicly accessible for attacking which may provide access to the secure area.
A system that is not publicly accessible is not contactable in any way online, it is hosted on a private network behind firewalls.
To go with your analogy, in IT terms, your building is publicly accessible because the public can walk up to it and attempt to social engineer your receptionist or exploit your door access system. Were you in a truly private building - think underground military bunker with armed guards at a gate far from the door security systems and receptionist (the firewall), then you could consider your building private.