SAP HR: Should it be a separate system or a shared one?

[Former Member]

Hi friends,

We are in the decision point in our project about the system landscape of SAP HCM system.

There are three options we are considering about SAP HCM installation:

1. On a separate system

2. On a shared system with other modules but separate client

3. On a shared system & client with other modules.

The most important concern of my client is the confidentiality of the salary & payroll data.

Thus, they think that we may enhance confidentiality if we separate the HR system physically.

However, there will be a lot of integration points of HR module with other modules (FI, CO, cProjects), thus I believe that separating the HR system would slow down the speed of the project.

Please share you ideas & experience with me on this regard so that I can offer them a logical solution.

Thanks in advance,

Best Regards,

Dilek

[JPReyes · Accepted solution]

If I was you.... same system/same client.... theres security steps that you can take to protect the data and in the long terms is much better administration wise

regards

Juan

[Former Member · Accepted solution]

Thanx Juan,

I prefer same system/same client architecture as well; however, I need a logical reasoning to declare to my client. Could you pls throw some light on the security steps you have mentioned?

Dilek

[Former Member · Accepted solution]

Hello Dilek,

I assume that security Juan means control via authorizations. I mean say for data integrity purposes your client wants that CO department users should not have access to payrolls then this can easily be controlled using roles and authorizations.

Regards.

Ruchit.

[JPReyes · Accepted solution]

Basically you need to sit down with your project manager and create a blueprint of your scenario... as your system is already running and you just need to focus on HR implementation and security.

Security wise you need to create roles for the people who will be testing and handling the module, once the roles are created you need to do extensive integration testing so you can ensure that no information leak is possible. if you have no expirience with authorization in HR i'll recommend you to do HR940 course.

Also, remember looking into SOD's

Hope this help

Juan

[Former Member]

Hi,

As suggested by Juan and Ruchit you can restrict the things by roles.

It is not needed to go for a new system or new client.

Going for a new client would again occupy more space then again you need to maintain the master data and all the other stuff. I think you should use the same client and restrict the users with the authorization mostly we restict the users using the auth object p_orgin.

Regards,

Vamshi.