Mechanisms exist to limit access to security functions to explicitly-authorized privileged users.
Does the organization limit access to security functions to explicitly-authorized privileged users?