1. Security Levels: "Data security starts by recognizing that different sets of information require different levels of security," he says. For instance, the enterprise might give outside business partners access to design data for a new product they are developing jointly. It might restrict access to the corporate e-mail system to employees, and restrict access to corporate financials and employee and customer personal information to specific individuals.

2. Security Policy: This defines exactly who sees what information on the enterprise network. The beauty of modern, network-based IT architectures is that all information is potentially available on the network. The problem is that all information, including information regulated by Sarbanes-Oxley and other regulations, is potentially available to anyone who can get on the network.

3. Compliance: In the worldwide business environment that many companies operate in today, this is a complex area because each country has its own regulations. Thus it's not enough for a U.S.-based company to meet Sarbanes-Oxley and HIPAA requirements for protecting financial and personal medical information. If that entity also operates in Great Britain, for instance, it must also secure employee personal information and track any access to that information to meet British laws. Even if it does not have operations in the U.K., in this age of identity theft, high security for employee and customer personal information is simply good business.

4. Ease of Use: This is vital for good security. Without it, users won't obey security rules. Among business users, security has the bad reputation of getting in the way of accomplishing anything. Faced with having to remember complex, 50-character password strings that change monthly, users will write the passwords on sticky notes and attach them to monitors, making the passwords available to anyone who walks past their office door.

5. Role-based Security: "This can be useful for some applications, and SAP, for instance, employs it," Rothman says. However, it has its limits, and Sarb-Ox, for instance, requires that individuals accessing regulated corporate financial information be individually identified, and that everything they do with or to that information be logged under their name.