SAP Access Control Project

[Former Member]

Dear All,

I am preparing a proposal for SAP GRC Access Control.

At the moment, I am having some trouble with the cleansing part.

I want to know if role cleansing is a part of the project? If it is, then how one can estimate the time to do this activity?

I thought it would depend on the number of roles, number of users and the rulet set.

I am told by some that cleansing in not actually a part of the project. Maybe the effort analysis for cleansing can be assessed after roles and user's analysis.

Please help. Thanks in advance

Aj

[RUDAVATH]

Hi,

I am new to SAP GRC AC, and would like to know about SAP GRC AC implementation proposal.

How do we prepare the proposal, scope for GRC AC, and procedure for effort estimation.

Do we have any standard guidelines or check list in preparing the same.

As you mentioned you are preparing proposal for GRC AC(By this time you could have prepared already) can you knidly share me the procedure you followed for your project.

I would like to know it for SAP GRC AC 5.3.

Regards,

Krishna R

[Former Member]

Aj, important to note that very first step to this project is to customize the out of the box rule set from RAR (we had over 1 million violations out of the box) when we customized the rule set to our company specifc needs/concerns, the # of sod violations dropped exponentially. During this process, we risk rated all tcodes used in the last 2 years to low, medium and high, and then concentrated only on high risk violations. IE: some tcodes may not be in use at your company or in scope. Then you could consider if there are any mitigating controls tied to sod risk violations that would help minimize the risk so that you could focus first on roles tied to risk violations where you don't have any manual mitigatation. This largely depends on how big the organization is and how many roles/users are on the system. Hope that helps!

[Former Member]

If you are refering to Project as 'Implementation of GRC AC 5.3'....... then cleaning roles is not part of it...

GRC AC 5.3 help organizations clean their roles.

regards,

Surpreet

[Former Member]

Thanks Surpreet.