A method and apparatus for utilizing a securable object in a storage management system is described. In one example, a security descriptor from a securable object is obtained. At least one security identifier (SID) and an access mask are subsequently acquired from the security descriptor by a security reference monitor (SRM). Lastly, the backup process creates a database entry that associates the securable object with the at least one SID and the access mask.