Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Grc 10 training


Published on

SAP GRC 10 online Training is result oriented training.

Published in: Education, Technology, Business

Grc 10 training

  2. 2. ACCESS CONTROL 10.0: INTRODUCTION Access Control 10.0: Introduction SAP BusinessObjects Access Control is an enterprise software application that enables organizations to control access and prevent fraud across the enterprise, while minimizing the time and cost of compliance. The application streamlines compliance processes, including access risk analysis and remediation, business role management, access request management, superuser maintenance, and periodic compliance certifications. It delivers immediate visibility of the current risk situation with real-time data. Access Control 10.0 is part of newly released SAP Governance Risk & Compliance (GRC) 10.0 which also comprised of Process control 10.0, Risk Management 10.0 and Global Trade Services. The greatest value in GRC 10.0 is the Harmonization of Access Control, Process Control and Risk management which ultimately results in shared processes, data and user interface with reduction in redundancy. GRC 10
  4. 4. Front end: The front-end needs a web browser or (optionally) a client installation of the NetWeaver Business Client The web browser can be used to access the embedded NWBC or GRC via the NetWeaver Portal The Adobe flash player 10 is used for displaying dashboards e.g. RM heat mapOverview of SAP BusinessObjects Access Control 10.0 SAPGUI 7.10 PL 15 or higher is required for administration or customizing tasks –note that SAPGUI 7.20 is recommended due to the end-of-maintenance of SAPGUI 7.10 The Crystal Reports Adapter (CRA) is required for viewing (GRC) Crystal Reports. GRC 10
  5. 5. Portal: The NetWeaver Portal 7.02 can be used optionally The GRC Portal Content contains the GRC Portal UI elements to access the GRC suite The Portal’s AS Java can contain an Adobe Document Services instance, in effect Portal and ADS may be shared on one AS Java instance ERP and Non SAP Business Applications: The GRC solutions can communicate with SAP ERP and non-SAP business applications via plug-ins NW Function Modules hold the AC functions for ERP systems without HR (former non-HR RTA) PC relevant features are contained in the plug-in GRCPIERP, for example, for running automated controls and the HR relevant functions for AC (former HR RTA) GTS functions are part of the SLL-PI plug-in, for example, for GTS integration into the Logistics, HR, FI/CO and/or HCM processes in SAP ERP Non-SAP ERP systems can also be connected via adapters from an SAP Partner company
  6. 6. BI Content: NetWeaver BW can be used for reporting via the GRC BI Content The GRC BI Content is part of BI Content 7.06 NetWeaver BW 7.02 is used for the GRC BI Content. Identity Management: AC can be integrated bi-directionally to IdM solutions for provisioning and risk analysis NetWeaver IdM7.2 is required for integrating with AC 10.0 Adobe Document Services: An instance of Adobe Document Services (ADS) should be accessible from the GRC AS ABAP for generating offline forms . Although it is technically optional, it is highly recommended for generating PDF reports These ADS can be an existing instance and can also be shared with other applications The Portal’s AS Java can contain an Adobe Document Services instance, so Portal and ADS may be shared on one AS Java instance.
  7. 7. NEW AND ENHANCED FEATURES: 1) Enhanced Visualization and Streamlined Navigation – This enhancement provides a common look and feel with configurable role-based user access for GRC functions from the SAP Portal or SAP NetWeaver Business Client (NWBC). Streamlined user navigation with shared work centers emphasizes function rather than component. This significantly reduces duplication of menu items (e.g., one inbox, not three) and makes possible sharing of data and functions. Menu items seen by the individual user within each work center is controlled by the user’s GRC role(s). This also enables data shared across components to be viewed differently by different users GRC 10
  8. 8. NEW AND ENHANCED FEATURES: Improved Reporting – GRC reporting leverages the Business Suite ABAP List Viewer (ALV) – Crystal integration framework to present and personalize ABAP (WebDynpro) reports and convert into Crystal reports. This lowers the TCO and extends the benefits of Crystal without the need for a separate BOE server. It also reduces the time spent by business users on reporting needs. Custom Crystal reports with embedded graphics can also be created easily with Crystal Designer. GRC 10
  9. 9. SEPARATION OF DUTIES Separation of duties (SoD) is the concept of having more than one person required to complete a task. In business the separation by sharing of more than one individual in one single task shall prevent from fraud and error. The concept is alternatively called segregation of duties GRC 10
  10. 10. SOD RISK MANAGEMENT PROCESS OVERVIEW SAP has developed a three-phase approach to risk management. By applying this method, it is possible to implement a process for segregation of duties (SoD) risk management.The process begins by defining the risks, and building and validating rules. GRC 10
  12. 12. Segregation of Duties and Critical Actions: In a Sarbanes Oxley Act regulated environment, business need to define their access controls based on segregation of duties (SoD). In some cases, it is challenging to define SoDs because in many cases, processes are shared among business areas. Below are examples of risks in non- segregated duties GRC 10
  13. 13. Rule Building and Validation : After risk recognition, the second step in Phase One of the SoD Risk Management process is Rule Building and Validation. GRC 10
  14. 14. GRC 10
  15. 15. Rule Building Process: Rules include risks, functions, and business processes. The main components of the rule building process are shown below. Access Control automatically generates the rules as permutations of the different actions and permissions derived from the combined functions. GRC 10
  16. 16. Functions: Functions include specific actions commonly used for a job role or set of tasks, for example Maintain General Ledger Master Records or Post Journal Entry. Authorization to perform certain combinations of functions results in a risk. GRC 10
  17. 17. Rule Structure: Actions and permissions combine to form functions. Functions in certain combinations result in a risk. Risks are associated with business processes and all the components come together to form rules. Rules are collected in a rule set. GRC 10
  18. 18. PHASE TWO OVERVIEW The purpose of this phase is to provide business process analysts and business process owners with alternatives for correcting or eliminating risk. Risk Analysis During Risk Analysis, perform a security analysis to identify risks for: Simple roles Composite roles Users Review the roles to determine how certain personnel might be restricted from performing undesired activities by checking: Objects Fields Values GRC 10
  19. 19. PHASE 2 FIGURE GRC 10
  20. 20. RISK REMEDIATION OVERVIEW The purpose of the remediation phase is to determine alternatives for eliminating issues in roles. The recommended approach is to resolve issues in the following order: Single roles This is the simplest place to start Prevents SoD violations from being reintroduced Composite roles Users Risk Remediation Use a simulation to perform a "what if" analysis on the assignment or removal of user actions Use the Management view or Risk Analysis reports for analysis Security Administrators should document the plan Business Process Owners should be involved and approve the plan Simulation Simulation allows you to preview the result of changes to roles and user actions to see if your changes create new risk situations before implementing them Decide whether to add or remove a value GRC 10
  22. 22. EXAMPLES OF MITIGATION CONTROLS Examples of Mitigation Controls Review of strategies and authorization limits Review of user logs Review of exception reports Detailed variance analysis Establish insurance to cover impact of a security incident Types of Mitigation Controls Preventative Controls: minimize the likelihood or impact of a risk before it actually occurs Detective Controls: alert when a risk takes place and enable the responsible person to initiate corrective measures Best Practices Segregate creation and approval from assignment Use mitigation as a last resort for exceptions left over from remediation efforts that have legitimate business reasons to not use SoD controls GRC 10
  24. 24. THE GRC ARCHITECTURE GRC solutions share a common technology platform and can be installed on a single NetWeaver ABAP system. GRC 10
  25. 25. GRC COMPONENTS ComponentsGRC 10.0 runs on AS ABAP 7.02 SP6 or higher. The installation components are broken out as follows: Access Control, Process Control, and Risk Management are contained in one ABAP add-on GRCFND_A Global Trade Services resides in a separate add-on SLL-LEG Nota Fiscal Eletronica has its own add-on SLL-NFE Content Lifecycle Management (CLM) contains functions for transporting GRC business data, for example, Access Control rules or Process Control controls. CLM has the same version requirements as the GRC 10.0 solution and is installed during the GRC installation. CLM can be disabled if not required. GRC customizing is transported using the standard ABAP transport system. GRC 10
  26. 26. ACCESS CONTROL 10.0 ARCHITECTURE NetWeaver ABAP is the underlying platform Harmonized with the other GRC 10.0 applications Leverages existing NWABAP investments: Role comparison at Action or Permission level Comparison between roles within Access Control Harmonization with Process Control and Risk Management allows users to leverage master data GRC 10
  27. 27. ACCESS CONTROL ARCHITECTURE COMPONENTS Access Control constitutes a set of core components: Access Risk Analysis and Management Compliance Certification Review Role Management Role Mining Superuser Access Management Access Control Repository GRC 10
  28. 28. GRC COMMON COMPONENTS Access Control uses a set of GRC common components as part of the harmonization of the GRC suite. These components are also available to Process Control and Risk Management: GRC Master Data Workflow Reports and Dashboards GRC 10
  29. 29. NETWEAVER COMPONENTS Access Control uses ABAP Web Dynpro as the user interface or UI technology. The GRC solution can be presented to end users by using either NWBC (NetWeaver Business Client) or through the use of SAP Portal. Configuration for Access Control is executed using the SAP IMG via the SAP GUI, which is common across the GRC suite. Access Control connects to SAP and non-SAP systems with adapter or IdM systems using the integration framework. The ABAP database is the common repository for all Access Control data. GRC 10
  30. 30. GRC 10
  31. 31. SECURITY AND AUTHORIZATIONS You are planning a solution and must be able to explain object-level security, authorization requirements, and identify delivered roles and security objects. Object-Level Security Object-Level Security gives you the ability to limit access for end users to what they need to see at a granular level. you can limit access by function, risk, user, or anyother authorization objects available within role maintenance. GRC 10
  32. 32. Authorizations To configure the IMG, you need: PFCG role(s) relative to specific components to be configured PFCG role(s) sufficient to configure SAP workflow and other non-GRC technologies PFCG role(s) on GRC and non-GRC systems to set up Continuous Monitoring To access GRC 10.0 solutions, you must have at least the following: Portal authorization or NWBC authorization Applicable PFCG base roles GRC 10
  33. 33. PFCG role(s) relative to specific components (AC, PC, RM) to be used Using Access Control with GRC Solutions If you use Access Control with other GRC solutions, you can leverage this functionality to: Manage PFCG roles used with GRC Create GRC users Assign GRC PFCG roles to users Perform SoD analysis for PFCG role authorizations Assignment of entity-level authorization (via application role assignment) and ticket-based authorization (via substitution or transfer) must be done in the respective component. GRC 10
  34. 34. INSTALLATION Installation Prerequisites –Server NetWeaver AS ABAP 7.02 SP6 or higher Installation Prerequisites –Back-end For ERP systems that will install Access Control Plug-In the following prerequisites must be met: For SAP ERP system 4.6C, the system must be at SAP_BASIS Support Pack 55 For SAP ERP 4.70 system, the system must be at SAP_BASIS Support Pack 63 For ERP 2004 system, the system must be at SAP BasisSupport Pack 18 For ERP 6.0 system, the system must be at SAP_BASIS Support Pack 13 For NetWeaver systems that will install Access Control Plug-In the following prerequisites must be met: For SAP Basis 4.6C, the system must be at SAP_BASIS Support Pack 55 For NW 6.20 system, the system must be at SAP_BASIS Support Pack 63 For NW 6.40 system, the system must be at SAP_BASIS Support Pack 18 For NW 7.00 system, the system must be at SAP_BASIS Support Pack 13 For NW 7.01, the system must be at SAP_BASIS Support Pack 02 For NW 7.02, the system must be at SAP_BASIS Support Pack 01 For SAP Basis 710 system, the system must be at SAP_BASIS Support Pack 04 GRC 10
  37. 37. ACCESS CONTROL INSTALLATION NOTES Installation Notes SAP Note 1490996: Install SAP GRC Access Control 10.0 on SAP NW 7.02 SAP Note 1500168: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 46C NW SAP Note 1497971: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 620 NW SAP Note 1501882: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 640 NW SAP Note 1500689: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 700 NW SAP Note 1503749:Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 710 NW SAP Note 1500169: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 46C ERP SAP Note 1497972: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 620 ERP SAP Note 1501880: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 640 ERP SAP Note 1500690: Install SAP GRC Access Control 10.0 Plug-In on SAP BASIS 700 ERP
  38. 38. INSTALLATION OF MAIN COMPONENTS OFAC/PC/RM 10.0 General Steps: 1.Main installation components: GRCFND_A 2.Download the installation packages from Service Marketplace 3.Install with the transaction SAINT 4.Follow the detailed instructions from the SAP Note 1490996 5.Apply the most recent Support Packages GRC 10
  39. 39. INSTALLATION OF PLUG-IN FOR AC/PC 10.0 ON ERP General Steps: 1.Main installation components: GRCPINW GRCPIERP 2.Download the installation packages from SMP 3.Install with the transaction SAINT 4.Follow the detailed instructions from the SAP Notes 1500689 and 1500690 5.Apply the necessary Support Packages if there is any Note: Plug-Ins vary depending on back end ERP system. Attention:The AC 10.0 plug-ins will upgrade any existing RTA from previous AC releases. This means that any AC instance on running 5.X will stop working after the plug-ins are installed. GRC 10
  40. 40. GRC 10.0 POST-INSTALLATION 1.Client Copy 2.Activating Applications in Client 3.Check SAP ICF Services 4.Activating BC Sets 5.Creating the Initial User in the ABAP System 6.Activate Profile of Roles Delivered by SAP 7.Activate Common Workflow GRC 10
  41. 41. CLIENT COPY T-code which starts from SCC* 1. Choose Administration --> System administration --> Administration >Client admin.>Client Copy-->Local Copy. 2. Select a copy profile. 3. Enter the source client. click the tick mark it will take some time .... you can refer the link below o.pdf GRC 10
  42. 42. ACTIVATING APPLICATIONS IN CLIENT Call the customizing with transaction SPRO Choose SAP Reference IMG Expand the Governance, Risk and Compliance > General Settings node and choose Activate Applications in Client Choose New Entries
  43. 43. ACTIVATING APPLICATIONS IN CLIENT Click the first row and select the GRC solution(s) required for your project Then choose the Activecheckbox Click Save Note: you may have to create a transport request EXAMPLE IS OF GRC –PC,YOU MAY NEED AC IF YOU NEED ONLY ACCCESS CONTROL GRC 10
  44. 44. CHECK SAP ICF SERVICES Call transaction SICF Click the Execute icon GRC 10
  45. 45. CHECK SAP ICF SERVICES Expand the node default_host-> sap -> public Right click publicand choose Activate Service Choose Activate Service for all sub-nodes GRC 10
  46. 46. CHECK SAP ICF SERVICES Proceed likewise with the node default_host- > sap -> bc Activate all sub-nodes too GRC 10
  47. 47. CHECK SAP ICF SERVICES Now activate the node default_host-> sap -> grc Also activate all sub-nodes GRC 10
  48. 48. ACTIVATING BC SETS Call transaction SPRO again Click SAP Reference IMG Click Existing BC Sets in the next screen GRC 10
  49. 49. ACTIVATING BC SETS Select a BC Set Click “BC Sets for Activity” GRC 10
  50. 50. ACTIVATING BC SETS From the menu choose Goto >Activation Transaction These BC sets can also be activated via transaction code SCPR20 GRC 10
  51. 51. ACTIVATING BC SETS Activate the corresponding BC sets. Proceed likewise for all required PC, RM, and/or AC BC sets For a complete list of BC Sets please refer to the PC/RM/AC install guide! NOTE:BELOW EXAMPLE IS FOR ACTIVATION ON TIME FRQUENCY FOR GRCPC:PROCESS CONTROL. GRC 10
  52. 52. ACTIVATING BC SETS When activating always use “Expert” mode GRC 10
  53. 53. CREATING THE INITIAL USER IN THE ABAP SYSTEM Call transaction SU01, create a user Assign following role to access GRC applications, such as AC •SAP_GRC_FN_BASE Assign following power user role to the person doing the customization of the product •SAP_GRC_FN_ALL Assign following role to the business users •SAP_GRC_FN_BUSINESS_USER Assign following role if you use NWBC as front end UI instead of Portal •SAP_GRC_NWBC GRC 10
  54. 54. ACTIVATE PROFILE OF ROLES DELIVERED BY SAP •Activate profile of roles delivered by SAP via transaction PFCG if you want to use them directly •For the list of the roles, please refer to Security Guide - here is an example of the SAP-GRC-NWBC role •Please use transaction “SUPC” for mass profile generation in case you want to generate profiles for multiple roles GRC 10
  55. 55. ACTIVATE COMMON WORKFLOW Call transaction SPROagain Click SAP Reference IMG Access Workflow node under Governance, Risk and Compliance > General Settings Execute Perform Automatic Workflow Customizing GRC 10
  56. 56. ACTIVATE COMMON WORKFLOW PERFORM AUTOMATIC WORKFLOW CUSTOMIZING Execute Perform Automatic Workflow Customizing Make sure that all tasks are green after the generation as show in the screenshot Note: you may have to create a transport request During the activation procedure you might receive an error message, then check the created system user „WF-BATCH“ in SU01 if the user has sufficient roles assigned –see SAP Note 1251255and the GRC Security Guide. You may need to run program RHSOBJCH to fix HR control tables GRC 10
  57. 57. ACTIVATE COMMON WORKFLOW PERFORM AUTOMATIC WORKFLOW CUSTOMIZING Maintain the Prefix Numbers to your needs or like shown in the screenshot GRC 10
  58. 58. ACTIVATE COMMON WORKFLOWPERFORM TASK- SPECIFIC CUSTOMIZING Execute PerformTask- Specific Customizing Expand the GRCnode. Click the Assign Agents link at the right side of the GRCnode. Note: if no folders are visible below the “GRC“ folder please run report “RS_APPL_REFRESH” in SE38 GRC 10
  59. 59. ACTIVATE COMMON WORKFLOWPERFORM TASK- SPECIFIC CUSTOMIZING Assign Task as General Task via Task Attribute. Make sure all tasks that are not using Background task have been assigned as General Task. GRC 10
  61. 61. ACTIVATE COMMON WORKFLOWPERFORM TASK- SPECIFIC CUSTOMIZING Click the Properties icon Set the Linkage Status to No errors Make sure Event linkage activated is checked. Set Error feedback to Do not change linkage Be sure to activate all WS. GRC 10
  62. 62. ACTIVATE COMMON WORKFLOWPERFORM TASK- SPECIFIC CUSTOMIZING Repeat the first four steps to activate the solutions you need (e.g. for Access Control “GRC-AC”) Note: task-specific customizing for GRC-AC is notavailable in case you have the GRC plug- ins installed in your GRC system, check the Appendix for perfomingthe customizing in this case GRC 10
  63. 63. POST-INSTALLATION TO FIRST EMERGENCY ACCESS •Requirements oAdding connector to SUPMG scenario oCreating users and assigning roles oVerifying time zones •Configuration oMaintaining AC owners oAssigning owners to firefighter IDs oAssigning firefighter IDs and controllers to firefighters oCreating reasons codes •Starting an emergency access session •Managing Logs oRunning log collection oViewing the firefighter reports GRC 10
  65. 65. ADDING CONNECTOR TO SUPMG SCENARIO To create access requests it is required to have the SUPMG scenario linked to the connector, this is done via IMG: GRC 10
  66. 66. CREATING USERS AND ASSIGNING ROLES Please create users and roles as needed. Remember to synchronize again the repository (program GRAC_REPOSITORY_OBJECT_SYNC ). These roles are provided as examples and customer roles need to be created based on their authorizations. In the AC systemRole Firefighter userSAP_GRAC_SUPER_USER_MGMT_USER FirefightercontrollerSAP_GRAC_SUPER_USER_MGMT_CNTLR FirefighterownerSAP_GRAC_SUPER_USER_MGMT_OWNER In the target systemRole Firefighter IDSAP_GRAC_SPM_FFID In the AC system the Firefighter ID role is configured in ParamID 4010 (Firefighter ID role name) Reminder: end users will require also the roles based on SAP_GRC_FN_BASEand SAP_GRC_FN_BUSINESS_USER GRC 10
  67. 67. VERIFYING TIME ZONES For logs to be properly captured the time zones in the connected ERP systems need to be configured to match the operating system and also the AC server time zone. This is done in IMG under SAP NetWeaver General Settings Time Zones Maintain System Settings GRC 10
  68. 68. CONFIGURATION Maintaining AC owners Assigning owners to firefighter IDs Assigning firefighter IDs and controllers to firefighters Creating reasons codes GRC 10
  69. 69. MAINTAINING AC OWNERS Go to NWBC Access Management GRC Role Assignments Access Control Owners and maintain the controllers and owners as shown below: After this is done it is possible to assign those to FireFighterIDs. GRC 10
  70. 70. ASSIGNING OWNERS TO FIREFIGHTER IDS In Access Management go to SuperuserAssignment and click on Owners. Here owners are assigned to firefighter IDs. GRC 10
  71. 71. ASSIGNING FIREFIGHTER IDS AND CONTROLLERS TO FIREFIGHTERS Now you need to assign firefighter IDs and controllers to users. This is done by going to SuperuserAssignment Firefighter IDs Note: Multiple firefighter users and controllers can be assigned to a multiple firefighter ID. GRC 10
  72. 72. CREATING REASONS CODES The reason codes available for firefighter users are maintained under Superuser Maintenance Reason Codes GRC 10
  73. 73. STARTING EMERGENCY ACCESS Starting a firefighter session Login to the AC system using the firefighter user and launch transaction GRAC_SPM You will be able to connect to the target system using the firefighter IDs previously assigned GRC 10
  74. 74. MANAGING LOGS Running Log Collection Viewing the firefighter reports Running log collectionForeground mode The foreground job for log collection can be executed from the “Update Firefighter Log Button” which can be found in the following path: Reports And Analytics Super User Management Reports Consolidated Log Report
  75. 75. RUNNING LOG COLLECTIONBACKGROUND MODE The Background Job for Log Collection can be scheduled periodically from SM36 using program GRAC_SPM_LOG_SYNC_UPDATE. GRC 10