Set-up/Maintenance Dependencies

In any decision regarding who is to handle security administration, you must consider the amount of set-up and maintenance activity required.

This depends on:

The number of corporate entities, for example, departments, divisions, applications.
The number of defined users as well as employee turnover requirements.
The number of data processing resources to be protected.
The existence of standards.
The number of hardware entities to be protected. For example, if terminal protection is used heavily and regular network reconfiguration is a fact of life, security maintenance based on terminal ID revisions could be heavy.
The application development activity. If heavy development is being pursued as in most installations, the security requirements for maintenance activity and security review activity must be considered for new and revised application segments.
Auditing requirements and frequency of change to same.
The number of special routines requiring user-defined resources, and the maintenance activity against them.