GRC Access Control

GRC Components– Work module of GRC : 

Compliant User Provisioning:

Compliant User Provisioning (CUP) is a capability of SAP GRC Access Control. It provides compliant user provisioning across enterprise systems. Included are access request self-service, approvals, compliance checks,proactive resolution of access controls, and provisioning.

CUP also provides standard reports.

Both CUP and RAR capabilities introduce a configurable reporting data mart that enables customized reporting by integrating your reporting tool of choice.

·         The data mart extracts the relevant data from the RAR and CUP and converts the data for reporting purposes

·         The data mart is nonhistorical

·         Data mart schema are published, which enables customers to integrate with any reporting tools.

CUP combines predefined roles and permissions with configurable workflow capabilities, thus automating and expediting user provisioning throughout an employee’s lifecycle with the company.

CUP prevents violations of separations of duty (SoD) and helps to ensure corporate accountability and compliance with Sarbanes-Oxley, and other laws and regulations.

Users can request system access using a context-based selection of role descriptions that are defined using the Enterprise Role Management (ERM) functionality, another capability in the SAP BusinessObjects Access Control application.

When a user requests access to a system, CUP automatically forwards the access requests to designated managers and approvers within a predefined workflow that is customized for the enterprise. The CUP workflowengine considers the functional responsibility of the requestor and the type of access request being made, and automatically determines the appropriate routing for access approval.

CUP prevents access-approval delays by routing requests to back up approvers when primary approvers are unavailable or have not responded.

CUP automates the following user provisioning activities:

·         Creating users

·         Changing users

·         Deleting users

·         Locking/Unlocking users

·         Resetting user passwords

·         Assigning roles to users

·         Removing and changing role validity for users

·         User access review

=======================================

Risk Analysis and Remediation:

The Risk Analysis and Remediation (RAR) capability is a fully automated rules-based security audit and segregation of duties (SoD) analysis tool used to identify, analyze, and resolve risk and audit issues that relate to regulatory compliance.

Features

The Risk Analysis and Remediation capability:

·         Enables all key stakeholders to work in a collaborative manner to build ongoing SoD risk and audit compliance at all levels. This compliance includes User, Role, Profile, and HR Object levels.

·         Empowers security administrators, business process owners and internal auditors to prepare their SAP systems, and all other systems, for an audit.

·         Provides user friendly summary and drill-down reports, making the identification and resolution of Risks and audit issues a painless process.

o    RAR produces Risk Analytical Reports for selected users, user groups, roles, and profiles, allowing user administrators to identify potential risk issues before assigning a new role to a user, group or profile.

o    RAR produces reports on critical actions, critical permissions, critical roles, and profiles.

·         Introduces a configuable reporting data mart that enables customized reporting by integrating your reporting tool of choice (for both RAR and CUP):

o    The data mart extracts the relevant data from the RAR and CUP and converts the data for reporting purposes

o    The data mart is nonhistorical

o    Data mart schema is published, which enables customers to integrate with any reporting tools.

·         Includes an expandable starter set of rules, and enables risks to be identified and created in the system so that an administrator can correlate them with functions and associate each function to a business process. And then, the Risk Analysis and Remediation capability generates the rules to offset your identified risks, thus building on your rule set.

·         Provides comprehensive risk management functionality and powerful, easy to use, functionality to document Risk Mitigation Controls.

o    RAR enables you to perform a risk analysis to identify risks associated with a user, role, profile, or HR object. If you cannot eliminate a risk, you can use the capability to define mitigation controls. You also define monitors and approvers, assign them to specific controls, and create business units to help categorize mitigating controls.

·         Uses custom tables to store SoD data. It also ensures there is no interference with existing securityprocesses and procedures.

=============================

Enterprise Role Management

Enterprise Role Management (ERM) is a capability of the GRC Access Control application. The other Access Control capabilities interact with ERM.

Enterprise Role Management automates the definition and management of roles, allowing you to manage enterprise roles with a single unified role repository. The roles can be documented, designed, analyzed for control violations, approved, and then automatically generated.

This capability enables preferred practices to ensure that role definitions, development, testing, and maintenance are consistent across the entire enterprise.

ERM provides SAP security administrators, role designers, and role owners with a simplified means of documenting and maintaining important role information for better role management.

The features include:

·         Tracking progress during role implementation.

·         Monitoring the overall quality of the implementation.

·         Performing risk analysis at role design time.

·         Setting up a workflow for role approval.

·         Providing an audit trail for all role modifications.

·         Maintaining roles after they are generated to keep role information current.

=========================

Superuser Privilege Management

In emergencies or extraordinary situations, Superuser Privilege Management, a capability of SAP GRC Access Control, enables users to perform activities outside their roles under Superuser-like privileges in a controlled, auditable environment.

A temporary ID is assigned that grants the user privileged, yet regulated, access. This transfer of privileges from one person or role to another is called firefighting. Such a firefighting event might occur, for example, if an employee is injured and another employee has to perform the injured employee’s duties.

Superuser Privilege Management is an ABAP and Web-based capability that tracks, monitors, and logs the activities that are performed by a Superuser with a privileged user ID. Superuser Privilege Management also automates firefighting tasks such as defining firefighter IDs and assigning owners and controllers.

This capability is a back-end systems activity with limited interfacing to Compliant User Provisioning where related reports may be generated. For reports and other information, see the Compliant User Provisioning topics in this application help.