Theres no single normal behavior for any company, department, or user. Behavior patterns vary based on the work the user is doing at that moment, the insiders and outsiders with whom they need to share information, and even their location. The process of defining normal starts with the development of highly detailed information about usage, from which systems users interact with and which data they touch, to how they should handle unexpected situations. For smaller organizations, understanding these roles may be more difficult, as any employee might fill multiple roles.”]