I can easy follow Al.

It's my responsibility as a DBA to secure the data, and the security issues handled in SP4 are too grave to allow a roolback to SP3a.

Management (the top) has to sign off!

This is not a technical or an application problem - it's a business problem.