Gerry, keep on going with those next posts I am very interested. There is something bothering me, that is: - "4.Access to and security of the data is a responsibility of the data layer, and not managed by applications" SAS is an application when used with a rdbms/hadoop. - You already made a note on carefully checking the application-server settings for the ARM settings. Seeing user to bypass those and instead of those of the SASapp using the sashome/Foundation one. The use of predefined scripts (not servers) is hard to accept - Using more sources like a RDBMS (or hadoop) with another interface than the lockedin by SAS is bypassing all SAS auditing options. The requirement is normally to have a full guaranteed access logging for auditing/traceability.