Skip to Content
Product Information
Author's profile photo Thomas Frenehard

GRC Tuesdays: What really is SAP Governance, Risk, and Compliance (GRC)? – Focus on the Cybersecurity, Data Protection, and Privacy pillar

Data privacy and data protection regulations, and best practices, require organizations to implement both technical and organisational measures appropriate to the nature of data access and processing, and the associated risks of course.

Organizations need to ensure there are appropriate processes in place to test the effectiveness of both technical controls and policies, but also to undertake any required improvements.

This fourth blog on the “What is really SAP Governance, Risk, and Compliance (GRC)?” series will focus on the cybersecurity, data protection and privacy aspects of the portfolio.

Managing data protection and privacy

With that in mind, SAP solutions for Cybersecurity and Data Protection help customers:

  • Develop, maintain and implement policies and regulatory compliance, with auditable evidence of gaps and remediation
  • Provide technical access, masking and logging controls, geopolitical fencing, and management of digital identities
  • Protect system and landscape security, and perform early watches
  • Perform risk analysis and records of processing activities, linked technical measures, and data protection events to document and manage the appropriate and legal response
  • Implement security frameworks such as the one from the National Institute of Standards and Technology (NIST)

SAP Enterprise Threat Detection– Address cyber-threats with real-time intelligence

Features and functionalities:

*Analyze和efficiently enrich and correlate logs for review

*Evaluatefor automated detection of attack patterns with real-time alerting

*Investigate法医分析和建模的现有的一个d new attack detection patterns and dashboards

*Integrateto collect SAP and non-SAP log data

SAP Privacy Governance– Manage and comply with evolving data privacy regulations

Features and functionalities:

*Manage policiesby creating, disseminating, and acknowledging data protection and privacy (DPP) policies

*Survey and trackto gather and report on records of processing activities (RoPA)

*Access business impactby performing data privacy (DPIA) and cybersecurity business impact analysis

*Manage risks and controlsto identify and audit related risks and mitigating controls

*Monitor and reporton status and details via a unified cockpit

SAP Data Custodian– Gain greater visibility and control of your data in the public Cloud

Features and functionalities:

*Data transparencyto monitor and report on data access, storage, movement, processing, and location in the public Cloud

*Data controlto create and enforce public Cloud data access, location, movement, and processing policies

SAP UI Logging– Data access transparency and analysis

Features and functionalities:

*Log data accessfor coherent log of users’ input and system output on the user interface level, enriched with meta information for analysis

*Gain insightto understand how and which data is accessed, and set up alerts in case of access to critical or sensitive data

*Investigateby receiving alerts to specific, questionable activities, and enabling deep-dive into the log file to identify and prove improper data access

*Reportto draw on comprehensive access data to report internally and externally

*Integratewith SAP UI Masking for better data protection, and with SAP Enterprise Threat Detection for advanced and automated analysis of access

SAP UI Masking– Protect sensitive information in the user interface layer

Features and functionalities:

*Secure accessby determining sensitive fields and applying protective actions in runtime based on users’ authorizations

*Automate authorizationby determining users’ special authorization in runtime, based on static roles or dynamic attribute-role settings

*Gain insightsto understand who tries and who succeeds in accessing sensitive data, and whether to refine the solution setup

*Integrateby leveraging SAP UI Logging and SAP Enterprise Threat Detection to identify potential data abuse

I hope this helps in introducing the cybersecurity, data protection, and privacy offering from SAP’s Governance, Risk, and Compliance portfolio.

As a reminder, you can find all the other blogs in this series listed below:

I look forward to reading your thoughts and comments either on this blog or on Twitter@TFrenehard

Assigned Tags

      2 Comments
      You must be登录to comment or reply to a post.
      Author's profile photo Plaban Sahoo
      Plaban Sahoo

      Hi Thomas,

      Thanks for the doucument.

      Would you have the DPIA controls that can be mapped in GRC Process Controls.

      问候

      Plaban

      Author's profile photo Thomas Frenehard
      Thomas Frenehard
      Blog Post Author

      HelloPlaban Sahoo,

      First of all, thank you for your comments on this blog.

      Currently, there is no control mapping between SAP Privacy Governance and SAP Process Control. As a result, this is not a content that we provide.

      Nevertheless, you will be able to find more information about the predefined content in SAP Privacy Governance – including DPIA, in theQuick Start Guide: Compliance Requirements, Records, and Risks

      As you will be able to read at the bottom on the page, there is a reference to the “Privacy Risk Detection with SAP Privacy Governance (‏3KX‏)” package available from the SAP Best Practices Explorer. I believe this is what you are looking for.

      For your convenience, I have pasted the direct link here as well:https://rapid.sap.com/bp/scopeitems/3KX

      Finally, if you are also looking for manual and/or automated controls that can be leveraged in SAP Process Control, then I would suggest having a look at the blog on this topic:GRC Tuesdays: Fast Track Your Internal Control Project

      I trust this helps.

      Kind regards,

      Thomas