If you were the manager at a firm which deals with sensitive information of its customers, employees and other stake holders, how would you make sure that information is protected and is altered only by the designated authorized person