EBS R12.1 security settings

Dears all,
I have some question with EBS security, our security team mark for next gaps in security.
1) Lock all application account AHL,AHM,AK ... (exclude APPS )
2) Revoke ‘admin option’ from all privileges and roles APPLSYS, APPS, AR, ASO, CS, OKC and XNP

I succesfully implement this on test environment, but is it right?

I found some notes such as [ID 403537.1] but cannot find answer for my questions. Can you help me to investigate this issue?
And how I can set minimum right privileges for all application accounts (AHL,AHM and so on)

Thanks for help.