What attributes should be considered to assess the adequacy of System Configuration controls?