There is need for a scheme to ensure the security and privacy of the administrator and users. Providing security is different to providing privacy, because their goals differ. Security is based on organization goals, but privacy is based on user goals. Providing security and privacy must be according to organization constraints. The most important constraints in any organization are economic issues. A useful scheme must consider all these requirements. In this paper, we present a scheme that provides security and privacy and considers various constraints. We model the problem as a multi-objective optimization problem.