Hi,
This is an interesting topic.
Ill answer this question from an ICD (Maximo) point of view.
1.)First of all ICD has a Security group application that profiles which users access what.One can get granular by using conditional expressions on what functionalities are seen and to what extent.
2.)Audit can be enabled at the object level using the database config module so that one can have visibility on audit trails.
3)ICD or any other Service Management solution like TADDM or Netcool can push logs to a SIEM such as Qradar for security intelligence and correlation. ICD can then utilize the inherent capabilities of a SIEM for security intelligence for service management.
I still would like to hear more views on this,its definitely an interesting topic.
Abraham Muchina