Part 3: SAP authorization model for secure Partner Collaboration Global companies need to accelerate collaboration with design partners and suppliers while protecting intellectual property and complying with information protection agreements. In Part 3, we will show how the toolbox and models can be used to enable secure partner collaboration with a customer example.

1. Advanced Authorization for SAP Global Deployments Part 3: SAP authorization model for secure Partner Collaboration Andy Han, VP Products, NextLabs, Inc.

2. Agenda Objective Understand partner collaboration lifecycle for global SAP deployment Apply the 2-Layer authorization model Identify authorization tools used in the solution Presentation Quick Recap of Part I The Partner Collaboration Lifecycle Partner Collaboration requirements for global SAP deployment 2-Layer authorization model Authorization implementation Question and Answers

3. Part I: Map Requirements to Authorization Tools Understanding Global Deployment Authorization Requirements and Challenges Authorization Model – Clear Separation of Authorization Dimensions Introduction to the Authorization Toolbox

4. The Partner Collaboration Lifecycle Marketing Engineering Manu- facturing Logistics Sales Service

5. Partner Collaboration Authorizations Intellectual Property (IP) Licenses NDA, PIA, PIEA Patent Licenses Trade Secrets Third Party IP Licenses Contractual Obligations Classified, Top Secret, Need to Know

6. Business Authorization Dimensions Functional Access Determine the actions a user can perform Data Access Determine the data a user can see Governance Rules for access management Data Access Functional Access Governance

7. Authorization Requirements - Functional Marketing Engineering Manu- facturing Logistics Sales Service

8. Authorization Requirements - Data Intellectual Property Type PUBLIC PATENT TRADESECRET PROPRIETARY THIRD-PARTY PROPRIETARY COPYRIGHT TRADEMARK IP License IP Owner – IP Designee IP License (NDA, PIA, Patent License) Business Classification Program, Project Product Technology Family Customer (Service) Significant overlap with Export Classification – the same data will also have Export classifications.

9. Authorization Requirements - Governance Classification Processes IP Classification (type, owner, license) Business classification (Program, project, product, customer) IP Publication Process for publishing IP to external facing applications External User Company and Project assignments Managing the creation of accounts for external users with accurate information for company and project assignment IP License Management Managing IP licenses established by legal Marking, Audit and Record Keeping

10. Authorization Map Example

11. Access Control Subjects Roles Marketing Roles Engineering Roles Manufacturing Roles Logistic Roles Sales Roles Service Roles Legal Roles IT Administrators Supply Chain Management Attributes Program Contract Project Company Application / Scope of Work Technology

12. Functional Authorization Map

13. Data Authorization Map

14. Governance Authorization Map

15. Authorization Layers Subject 2 1 Functional Authorization Layer 1 3 1 3 3 Governance Data Authorization Layer 5 6 Resource

16. Authorization Toolbox Functional Authorization Layer SAP Authorization Concept Access Provisioning Custom Development Data Authorization Layer System Segregation Client Partitions SAP Authorization Concept PLM Access Control Model (ACM) Attribute Based Access Control (ABAC) Custom Development Governance SAP GRC Access & Process Control Identity Management Manual Authorization Management Procedures

17. Sustainable Authorization Management How many partner organizations will I collaborate with? How many programs or projects will I need to support? How many IP Licenses will I need to manage?

19. Define Transaction or Function Groups

24. Advanced Authorization Challenges Collaboration Security How do I share data and functions to enable global collaboration? How to I enable collaboration with external partners? How do I do more business around the world? How to I support systems 24/7 at the lowest cost? How do I limit access to data and functions for users in a specific region or LOB? How do I protect my company IP from leaking outside the company? How do ensure compliance with multiple global regulations? How do I control privileged IT users?

26. Multi Line of Business

29. Privacy

31. Helpdesk

33. External Access

34. Co-opetition

35. Multi Level Supply ChainCustomer Design Partners

36. Co-organized by NextLabs and SAP NextLabs Overview Policy-driven, information risk management software for Global 5000 enterprises. Help companies achieve safer and more secure internal and external collaboration Ensure proper access to applications and data Facts Locations HQ: San Mateo, CA New York, NY Hangzhou, PRC Malaysia 25+ Patent Portfolio Major go-to-market Partners: IBM, SAP, Microsoft “We allow companies to preserve confidentiality, prevent data loss and ensure compliance across more channels and more points with a single unified solution with unmatched user acceptance and total cost of ownership.” - Keng Lim, Chairman and CEO

37. Thank You! Questions? Ruth Stephens: 650-356-4801, ruth.stephens@nextlabs.com