Abstract: The invention relates to a method for the optimized assignment of access rights to IT resources managed by means of a security management system and to a correspondingly adapted security management system. According to the invention a security domain is defined on the basis of at least one attribute of IT resources and a plurality of authorization profiles is provided for the security domain. User groups are assigned to the domain and linked to profiles provided for the domain. IT resources for which the security management is responsible are allocated to the domain in accordance with the attribute defining the security domain, as a result of which user groups assigned to the domain receive access rights to the IT resources allocated to the domain in accordance with the profiles linked to them. The invention permits the user groups to be issued with authorizations that are tailored to the requirements of the individual groups.