Who has access?—The next step is to determine the persons
who have access to the systems on the network and how. Is
the system accessed only by employees? Do customers and
vendors also access the systems? Do employees access the
system from outside the office? Do customers access only
the web server via the Internet or do they perform remote
logins to the enterprise systems? The answers to these
questions will have significant impact on security