Hi Marina,
Security maintenance responsibility in BPC varies from customer to customer, but in general the business is charge, mainly because the business know the master data and its easy to use.
It really goes based on your customer requirement, therefore it's fine to pass the process onto the admin team. It is just a matter of creating a process.
Cheers,
Lucas