GRC Roles and Responsibilities – Role Owners

GRC Roles & Responsibilities – Role Owners

Role Owners will carry out the following tasks as part of their GRC-related responsibilities:
 Identify potential access changes, aligned to the business area’s functions, organization and
Segregation of Duties requirements.
o New or amended role definition.

o User assignments to new or amended roles

 Assist the SOD Coordinator with the assessment of new risks associated with proposed changes
 Formally request Production access changes (role activation and user/role assignment) when the
GRC risk analysis is completed and documented.
 Manage changes to SAP access from the MIT RolesDatabase , where appropriate. Note: there is
usually no SAP Security Admin involvement in this step for existing provisioning.
 Request assignment of users to Firefighter roles in GRC.
 Advise SAP Security of any Transfer Out / Termination
 Conduct regular reviews of
o Roles for the business area – who has them

o Users per business area – what roles they have

o Users per business area – what Risk/ Mitigation combinations are assigned

o GRC-ARA (SOD) analysis

o Assignment of Business Back-up FireFighter roles to Users

 Monitor access logs for business user "FireFighter" and IS&T Support role usage
Responsibilities Reference

TASKS PROCESS & STEP

1. New or amended roles 1
Initiate proposal for new or amended roles 1.1
Approve role design and initial build 1.5
Approve role transport to Production 1.9
Confirm results to allow RT ticket closure 1.13
2. Mitigation Analysis 2
Contribute advice to Mitigation Analysis and confirm result 2.1.d
Recommend final Mitigation Control to Risk Owner 2.4
Implement any new manual control processes 2.2
Carry out SOD Analysis and other mitigation controls 2.7 and see 5
3. Role Provisioning to Users 2
Request changes to role assignments 3.2
Make any MIT RolesDatabase provisioning 3.3
1
 GRC Roles and Responsibilities – Role Owners

TASKS PROCESS & STEP

4. FireFighter 4
If designated as a FireFighter Controller, request VPF BA or 4.6
IS&T BSA to take action, and review FFID logs. 4.8
5. Periodic Compliance review 5
Manage execution and review of Mitigation Controls and 5.M.1, 5.M.3
take any remedial action
Review Access Risk Analysis reports for the business area – 5.Q.2
may need to make some Role or User changes or 5.Q.3
may need to revisit the Mitigation Analysis process 5.Q.4
Review “owned” role assignments to users, and review 5.Q.5
business area users’ role assignments.
If designated as a FireFighter ID Owner , review FFID 5.Q.7
assignments to users
Propose recertification of assignment Mitigation Controls 5.A.2

REPORTS PROCESS
05 SUIM Roles (select by Role name) 3 and “Ad hoc”
 Single Roles assigned to Composite Roles
 Tcodes assigned to roles
06 User to Role Relationship 2 and 5
 Users assigned to a role
07 Role Relationship with User / User Group 1, 2 and 5
 Roles assigned to users or all users in the user group
08 SUIM Users (select by User Id) 3 and “Ad hoc”
 Compare role assignment for two or more users
09 Count Authorization for Users 5
10 Action usage by User, Role and Profile 1 and “Ad hoc”
11 Mitigation Control report (list of Mitigation Controls) Ad hoc and 2
12 User Level Risk Analysis report Run by BA or
 Analyze for SOD per user or user group SOD Controller:
 Analyze assignment of Mitigating Controls to 2 and 5
Risk/User combinations.

FORMS PROCESS & STEP

A: GRC Mitigation Control Change Request 2.4
B: GRC FireFighter Access Change Request 4

WORKFLOW OR EMAIL-TRIGGERED ACTIONS PROCESS & STEP

Email for FireFighter usage – if designated as a FFID Controller 4