The IT security policy provides categories for individual application, database roles, user groups and information sensitivity.