Users should know that access to certain programs and information is a privilege.

Users must be identifiable before they may gain access to the system.

The integrity of the information and the performance of the system should be protected.

The user must have the necessary authority to obtain access to the system and to use specific programs and software.

There must be an audit trail so that the system can prove that the person who accessed as the user has actually been the person doing the work on the system.