Table of Contents
1. What are the various types of firefighter IDs in SAP GRC?
Firefighter IDs grant temporary emergency access to vital transactions.
- User Firefighter ID—Independent login ID for emergency activities.
- Role-Based Firefighter ID—Issued as a temporary role rather than an ID.
- Owner—Approves and administers firefighter ID requests.
- Controller—Reviews and audits Firefighter activity logs.
2. Why is SAP GRC Access Control important?
- Prevents illegal access to crucial business data.
- Maintains audit and regulatory compliance needs such as SOX, GDPR, and HIPAA.
- Minimises security risks through the enforcement of Segregation of Duties (SoD) policies.
- Offers real-time monitoring and reporting of access risk.
3. What are the main components of SAP GRC Access Control?
- Access Risk Analysis (ARA)—Detects and examines possible security threats and SoD conflicts.
- Access Request Management (ARM)—automates and simplifies user access requests and approvals.
- Emergency Access Management (EAM)—Offers temporary high-level access for troubleshooting and critical operations.
- Business Role Management (BRM)—Assists in designing, managing, and analysing business roles.
4. What is Segregation of Duties (SoD) in SAP GRC?
SoD is a security concept that keeps one user from having incompatible responsibilities that can cause fraud. Example: A user should never have both create and approve authority for vendor payments. SAP GRC Access Control identifies and compensates SoD risks.
5. What is Access Risk Analysis in SAP GRC?
Access Risk Analysis enables organisations to identify potential security threats and policy breaches in user authorisations and roles. It guarantees users access to only the required transactions while avoiding SoD violations.
6. What is Firefighter ID in SAP GRC?
A Firefighter ID is an emergency access account with special privileges to enable a user to undertake important tasks temporarily when there are system problems. Everything done under a firefighter ID is tracked for auditing.
Example: A financial manager requires emergency access to resolve an urgent payment mistake. They can ask for firefighter access, complete the task, and logs will be audited later.
7. How does SAP GRC Access Control address Role-Based Access Control (RBAC)?
RBAC provides access to be granted by job roles and not individuals.
BRM (Business Role Management) assists in defining roles.
Users receive permissions by role and not direct access assignments.
Enforces compliance and SoD monitoring in big organisations.
8. What is MSMP in SAP GRC?
MSMP (Multi-Stage Multi-Path) is an SAP GRC workflow engine used to automate access request approval processes. It enables organisations to create custom workflows as per business needs.
Example: Financial access may require multiple approvals (HR, Manager, IT Security) prior to approval.
9. What is BRF+ in SAP GRC?
BRF+ (Business Rule Framework Plus) is a rule engine to define and control decision-making rules within SAP GRC workflows. It is utilised along with MSMP to configure access request approval and risk analysis rules.
10. What are the various types of risks in SAP GRC?
The main types of risks are:
- Segregation of Duties (SoD) Conflicts—A user has conflicting roles accessible.
- Critical Transaction Risks—There is a user with access to high-risk transactions.
- Superuser Access Risks—There is a user with excessive privileges that can be abused.
11. What is Access Request Management (ARM)?
ARM automates user access requests, approvals, and role assignments in SAP. New access can be requested by users from a portal, and approvals are carried out according to defined workflows.
12. How do you conduct role simulation in SAP GRC?
Role simulation enables administrators to preview the effect of granting a role to a user before they make the actual changes. This prevents unwarranted SoD conflicts and security threats.
13. What is the intention of role mining in SAP GRC?
Role mining examines historical access data for users to spot trends and provide recommendations for optimising roles. Role mining assists in establishing neat and efficient role designs in an organisation.
14. How do you set up Firefighter Logs in SAP GRC?
Firefighter logs are set up in EAM (Emergency Access Management). All actions done under a Firefighter ID are logged and sent for auditing. The logs contain:
- User actions were performed under emergency access.
- Transaction codes executed.
- Approver information for compliance.
15. What is Mitigation Control in SAP GRC?
Mitigation controls are compensating security measures used when SoD conflicts cannot be eliminated.
Example: A user needs both approval and invoice creation roles because of business requirements. A mitigation control-like review of all transactions by managers can be used to minimise risk.
16. What is the distinction between role-level and user-level risk analysis?
User-Level Risk Analysis—Verifies whether a single user has risky access privileges.
Role-Level Risk Analysis—Verifies whether a certain role has conflicts before assigning it to users.
17. What is the purpose of audit logs in SAP GRC?
Audit logs record all security-related modifications in SAP GRC, including:
- User role modifications.
- Access approvals and denials.
- Firefighter access usage.
These logs assist auditors and security administrators in monitoring who accessed what and when.
18. What is the difference between real-time and offline risk analysis?
Real-Time Analysis—Identifies risks in real-time when allocating a role.
Offline Analysis—Executes on a regular basis to scan for security threats in current user roles.
19. What is End User Personalisation (EUP) in SAP GRC?
EUP enables users to personalise their access request forms, simplifying it for employees to submit requests as per their requirements.
20. What is the GRC Cup Process?
The GRC CUP (Compliance User Provisioning) process is a computerised workflow that provides automated management for user provisioning and approval workflows in SAP GRC.
21. How do you deal with false positives in Access Risk Analysis?
False positives are when SAP GRC identifies a risk that is not really an issue. They can be minimised by:
- Refining risk rule sets.
- Implementing Mitigation Controls.
- Utilising BRF+ for sophisticated rule processing.
22. What are some best practices for SAP GRC implementation?
Establish clear access control policies.
Periodically review SoD conflicts and user access.
Automate workflows for efficiency.
Perform regular access audits.
23. How do you conduct mass role remediation in SAP GRC?
Mass Role Remediation is applied to rectify multiple roles that create SoD conflicts.
Steps:
- Determine risky roles through ARA (Access Risk Analysis).
- Apply role mining to recommend optimised role designs.
- Update roles in BRM (Business Role Management).
- Test new roles through role simulation.
- Update assigned roles and eliminate conflicting ones.
24. What are risk terminators in SAP GRC?
Risk Terminators are Access Risk Analysis (ARA) tools that prevent and correct security risks prior to providing access.
- Examine SoD conflicts.
- Recommend substitute roles to minimise risks.
- Verify compliance prior to role assignments.
25. What is the use of Rule Set in SAP GRC?
A rule set is a pre-defined list of risks, transactions, and authorisation objects utilised in Access Risk Analysis (ARA).
- Avoids SoD conflicts prior to assigning access.
- Can be tailored according to business requirements.
- Maintains audit compliance with security policies.
