Access control systems should consider all of the following EXCEPT:

It is important to balance the goals of the organization’s access control policy with the technical mechanisms. This includes reviewing the legal requirements that are necessary to protect access; conducting a risk analysis that identifies the typical threats to the system; reviewing accepted industry practices; identifying users who need access and what type of access they need; and identifying the sensitivity of the information stored and processed on the system.