What can be the hindrances to the effective utilization of criterion in a typical security organization?