There　is　need　for　a　scheme　to　ensure　the　security　and　privacy　of　the　administrator　and　users.　Providing　security　is　different　to　providing　privacy,　because　their　goals　differ.　Security　is　based　on　organization　goals,　but　privacy　is　based　on　user　goals.　Providing　security　and　privacy　must　be　according　to　organization　constraints.　The　most　important　constraints　in　any　organization　are　economic　issues.　A　useful　scheme　must　consider　all　these　requirements.　In　this　paper,　we　present　a　scheme　that　provides　security　and　privacy　and　considers　various　constraints.　We　model　the　problem　as　a　multi-objective　optimization　problem.