Privileges associated with each system/ application and the categories of user to which the privilege needs to/ can be allocated shall be identified. The allocated privileges should be evaluated to ensure that there is no conflict or compromise to the security of the system/ application.