For a multi-layered security plan one should start off at the weakest point in the system, this point would be the User Domain, "Employees are responsible For their use of IT assests". This domain is only as strong as its weakest user, meaning one person could possibly cause havoc for the system. The IT department has better things to do than sit and baby sit end users on their machines, so measures should be taken to reduce the chance that a users activity can pull down a system unknowingly or otherwise. The first thing that should be implemented is a mandatory Computer Security training session to educate the users on the proper use of work computers. Teach users to utilize their machine properly and you can effectively cut down on simple mistakes that leave the system open to attacks. Another point of security to look at is the user's ability to bring in and corrupt data using CDs, DVDs and USB drives. Automated virus scanning for files transferred from one of these devices or banning these items and disabling the use of them on the individual computers will fix most occurrences of this type of attack. Aside from the User domain another possible weak point is the Remote Access Domain, Being that the users are off site it is hard to say that the users password information has not been compromised. In such cases when abnormalities are spotted or data is accessed without proper authorization, data should be completely encrypted to prevent any sensitive materials from being sold or presented to the open market. To avoid people logging onto our systems remotely or by brute force attack, password delay and or denial after so many tries should be implemented, similarly real time lock out procedures should be taken in the event of theft of equipment. The workstation domain comes with its own problems such as unauthorized access to the system, the way to fix this