SAP COMPLIANCE MANAGEMENT DEMYSTIFIED

Daniella Lundsberg-Steele • Aug 22, 2017
This post comes from our partner Symmetry Corporation.

Executives often view compliance and compliance management with a mixture of confusion and dread. The word itself encompasses so much: financial controls and reporting (SOX), privacy and data protection (HIPAA), technological deployment (HITECH), FDA regulations (21 CFR Part 11), and even national security (ITAR and EAR). Although compliance management in an SAP landscape has a very specific meaning, it often eludes decision makers.

The tragedy is that compliance rules are designed to protect your assets, security, clients and reputation. When they use the threat of civil and criminal liability, it’s primarily to get you to do things you should be doing anyway. But to benefit from compliance, you need to understand how it’s structured, and how it fits into your SAP landscape and your business as a whole.

SAP Compliance Management and GRC

Compliance management refers to the controls put in place to restrict and monitor how users access, view and modify information within the SAP landscape. These tasks are handled by a Governance, Risk and Compliance program, such as ControlPanelGRC, or SAP GRC. Sarbanes-Oxley compliance management tasks include:

  • Establishing an internal control structure;
  • Validating the effectiveness of internal controls;
  • Certifying the accuracy of financial statements;
  • Preventing tampering;
  • Reporting detailed financial information;
  • Disclosing conflicts of interest.
GRC software monitors user access to identify potential segregation of duty and excessive access risks. For example, a single user shouldn’t be able to complete multiple portions of a business transaction (e.g. creating and paying a vendor), change the record of a transaction, or modify a financial report so that it excludes or differs from information in the database. Monitoring excessive access is also a top priority; as critical business transactions should only be granted to appropriate individuals to prevent both fraud and errors.

GRC programs also need to monitor financial controls, and verify all access and changes to documents in order to create an audit trail. This supports authentication of important records; helps admins and auditors spot suspicious activity and bugs in the system; and provides a powerful disincentive against fraud, leaks and tampering. Finally, the GRC program needs to be able to organize and report on effectiveness of controls, according to compliance rules, while maintaining proper access control. Auditors, investors and customers will all need access to different amounts of information, and much of the data auditors need could breach confidentiality or expose trade secrets if shared with other parties. Your compliance management program also needs to account for conflicts of interest and other mandated non-financial data.

Compliance management is crucial to nearly everything your company does. It’s how you verify payroll, sales or HR records, and protect information integrity and confidentiality. Whether it’s a trade secret, a 21 CFR 11 medical study, or HIPAA PHI, compliance management plays a role in keeping it safe.

Cyber Security and Compliance

At the risk of oversimplifying it, GRC prevents people from misusing your system; while cyber security prevents them from breaking in. We can illustrate this by picturing security in a museum. Standard (GRC) safeguards include:
  • Guards to enforce rules
  • Ropes and cases to prevent theft or damage to assets
  • Locked doors and alarms to restrict access to valuable assets
  • Cameras and motion detectors for monitoring
But what stops thieves from picking a lock and cutting the power to disable the alarm, or entering through a hatch in the roof? That’s where cyber security comes in.

People get confused by the different things each compliance regime says about cyber security. For example, PCI requires specific technical safeguards like encryption across open networks, firewalls and the elimination of default passwords, while HIPAA emphasizes broader principles, training and legal frameworks like BAAs.

But under a security best practices approach, the differences are actually pretty minor. HIPAA may not technically mandate encryption or firewalls, but they vastly reduce HIPAA compliance risks. Similarly, PCI might not require BAAs, but it’s in your company’s best interest to make sure your partners are adhering to stringent data protection standards.

Process Documentation and Quality Management

It may sound obvious, but cyber security and compliance management initiatives won’t go far, unless your company implements and consistently uses them — and that requires good process documentation. Everything from network configuration, to access control to daily system health checks and maintenance needs to be spelled out clearly and succinctly; the goal isn’t impressive, weighty tomes — its simple documents that spell out all necessary tasks.

This documentation needs to be incorporated into a quality management program. Although quality management doesn’t focus exclusively on security and compliance, many aspects have important functions in this domain, including technology policies, SOPs, auditing procedures, training, document control, and audit trails. Putting it all together almost always requires outside help.

Choosing an SAP Security and Compliance Partner

A provider needs to understand the compliance requirements of your industry, but doesn’t need to focus exclusively on them; often, experience across multiple industries is a better sign of a company that gets security and compliance.

It’s crucial, however, that your partner practices what it preaches. They should have a quality management program in place, and be able to show you things like:

Formalized Quality Policy, Quality Plan, and procedures
  • Audit trails
  • Version control
  • Sample Installation Qualifications
SOPs for critical systems should be recorded on controlled documents, approved by management, stored where no one can tamper with them, and trained and retrained regularly by anyone who does the work. And they should be ready to answer questions on anything from employee training and monitoring, to server hardening, to what happens when you call the help line.

In particular, they need good quality assurance, with separate task completion and verification staff. Finally, they should be ready to undergo regular 3rd party audits to assess and validate internal controls.

The Case for Bundling Security and Compliance with Managed Services

In the SAP hosting and managed services realm, companies that once had separate providers for hosting, IT project management, admin, DR/HA and so on, are moving to an integrated approach, citing benefits like lower cost, increased flexibility, greater knowledge base and less administrative overhead. In security and compliance management, however, tasks like IT security auditing, physical security auditing, GRC, monitoring and incident response are often farmed out to a web of different providers.

Forward-looking companies, however, are already starting to see the benefits of a unified managed services approach incorporating security and compliance. This approach lets you leverage your provider’s internal controls and knowledge base, along with their auditing framework. The people auditing, monitoring and hardening your system can work directly with the people running it, meaning better communication, quicker results and a lower administrative overhead. In an emergency, you won’t have to make frantic calls between your hosting provider, your DB admin and your network engineer — everyone is already working together, which means quicker resolutions, leading to better outcomes.

It also provides legal cover in the event of a breach, attack or outage. Successful hacks often simultaneously exploit weaknesses in hardware setup, software patching, GRC, training, monitoring and other domains. In a disaster, everyone goes into damage control mode, and you can end up with multiple agencies fighting it out in the courts (and in the press!) for years. If one provider handles everything, on the other hand, it’s their reputation on the line.

Getting SAP Security and Compliance Management Right

The most secure organizations don’t look at SAP compliance management and security requirements as onerous burdens, but as a way to protect their investments. Governance, risk and compliance provides a powerful framework to protect your organization from errors, corruption and costly mistakes, and industry-specific compliance regimes provide a similar bulwark against external threats.

But legal regimes and industry guidelines can’t account for every threat an organization faces. The right partner won’t view compliance regimes as boxes to check, but as one aspect of a program that includes risk assessment, training, auditing and monitoring, across your organization.

Interested in learning more about SAP Compliance, please contact Symmetry Corporation at 888-SYM-CORP.
By Daniella Lundsberg-Steele 25 Oct, 2023
As enterprise businesses in almost every sector strive to make the most of their data to compete in an increasingly digital economy, security is paramount. Data has never been more critical to business success, and the risks of it being vulnerable to attack have never been more severe. Securing that critical data remains a constant challenge, with workplaces being reimagined every day, with new challenges like architecting for remote work opening potential vulnerabilities and cyber-attacks becoming relentless and ever-more sophisticated. American Digital has partnered with Zerto to help secure data from ransomware by unlocking rapid air-gapped recovery. Our clients have truly benefited from custom-designed solutions based on their environments, data usage, and recovery planning. To learn more, please read our white paper here
By Ken Williams, American Digital Corporation 09 Oct, 2023
In recent industry news , networking giant Cisco has announced its exit from the hyperconverged market, leaving many of its Hyperflex customers in a state of uncertainty. The company has recommended that these customers transition to Nutanix, a move that has prompted important questions about the future of hyperconverged infrastructure and the choices facing IT professionals. In this article, we'll delve into Cisco's decision, its implications, and alternatives for customers facing this transition. Cisco Bids Farewell to Hyperconverged The news of Cisco's exit from the hyperconverged market comes as a surprise to many. Cisco's Hyperflex product line had gained some traction in the industry, and its sudden departure raises questions about the viability of the hyperconverged approach. The Nutanix Recommendation Cisco has advised its Hyperflex customers to consider making the switch to Nutanix, another prominent player in the hyperconverged infrastructure space. While Nutanix offers a robust solution, this recommendation prompts a critical question: Do you really want to switch from the control of one vendor who abandoned the market to another? A Cautionary Tale for IT Professionals Cisco's exit from the hyperconverged market serves as a cautionary tale for IT professionals. It highlights the importance of carefully evaluating technology choices and considering the long-term implications of vendor decisions. While hyperconverged infrastructure can offer advantages in terms of simplicity and scalability, Cisco's exit reminds us of the risks associated with relying on a single vendor for such a critical component of your IT infrastructure. HPE's Response: dHCI Hewlett Packard Enterprise (HPE) has been closely monitoring the challenges associated with hyperconverged infrastructure and has responded by introducing disaggregated hyperconverged infrastructure ( dHCI ). This approach offers the benefits of hyperconvergence while avoiding some of the limitations that have become apparent in traditional hyperconverged solutions. A Return to Converged Infrastructure Interestingly, many organizations that once embraced hyperconverged infrastructure have begun to return to more traditional converged infrastructure solutions. They have found that the flexibility and freedom afforded by converged infrastructure, with separate compute, storage, and networking components, allow them to better adapt to evolving business needs. Exploring Alternatives For Cisco Hyperflex customers who are unsure about making the switch to Nutanix, there are alternatives to consider. One option is to revert to Cisco Unified Computing System (UCS) for compute and select an appropriate Alletra model to support the workload. This transition would effectively shift from a hyperconverged model back to a converged one, offering greater flexibility and control. In conclusion, Cisco's exit from the hyperconverged market is a significant development that prompts IT professionals to reconsider their approach to infrastructure. While Nutanix may be a viable option for some, it's essential to evaluate all alternatives and carefully weigh the long-term implications of your choice. As the industry continues to evolve, flexibility and adaptability will remain key considerations in building a resilient IT infrastructure.
14 Jun, 2023
While some organizations approach digital transformation as a one-and-done project, the greatest benefits are only achievable through a long-term synergistic partnership. Take for example American Digital’s relationship with Generac Power Systems (NYSE: GNRC). As Tim Dickson, CIO of Generac, explained, “The Generac and American Digital story is a story of growth.” This began when Generac came to American Digital with a need for standard technology stacks, standard tooling, and standard tool sets that the team could use to manage its environment. “Due to the growth trajectory that the company was undertaking,” he continued, “we needed a partner that we could trust. We needed a partner that had local presence here in Wisconsin. And we needed a partner that could provide best-in-class solutions.” Through that partnership, American Digital would soon design and architect a solution that encompassed both hardware and software. This gave a relatively small team the ability to easily manage its large and rather complex manufacturing environment. Having that level of expertise from a partner able to guide your company is invaluable. Two talented teams working alongside one another in this manner can produce the right solutions that are future-driven and future-focused. And this makes it possible to easily grow and scale over time. As successes grow, so does that trust and those personal relationships. American Digital is focused not just on completing one project to our client’s utmost satisfaction but also on building and sustaining long-term partnerships. With a partner like American Digital at your side, you gain not only an IT solutions provider but also a trusted advocate that’s committed to your business success. Contact us to discuss the many ways we can enrich your organization.
07 May, 2023
While McKinsey and Company noted 2022 global mergers and acquisitions had finally settled to their pre-pandemic levels after the year prior’s all-time high, uncertainty continues to loom. Still weighing on decision-makers are supply chain issues, inflation, and geopolitical uncertainty. Meanwhile the soaring cost of labor, energy, and commodities makes it hard for organizations to deliver maximum value. But American Digital has long been a leader in helping enterprises seamlessly transform their digital operations amid divestiture, consolidation, spinoff, and major corporate restructure—and we’re doing so with little to no downtime or impact on business continuity. This is driven by experienced consultants and managed service capabilities that help large enterprise clients consolidate infrastructure, direct data appropriately by entity, establish a data management plan based on each organization’s IT strategy, and run operations seamlessly within its SAP environment. Consider the leading consumer packaged goods enterprise that came to American Digital during its divestiture to two entities. With four decades of experience in IT infrastructure, American Digital carefully managed all aspects of its $1.6B project over the course of seven months while providing an additional cost savings on SAP licensing and contract restructuring. While large restructuring projects for multinational and global organizations are inherently complex, American Digital has devised a tried-and-true process that can eliminate in-house stress and provide a seamless end-to-end transformation. We help guide your team through the entire process, identifying potential obstacles and notably reducing risk. Contact us to learn more about our digital transformation solutions specific to divestiture, consolidation, and spinoff.
By Daniella Lundsberg-Steele 20 Apr, 2023
The benefits in SaaS and cloud-based service models are immense—from the flexibility and value they offer to the freedom they provide in-house staff to focus on more important strategic objectives. But as more enterprises outsource their core business operations to managed service providers—and as access to crucial business data is shared—organizations need added assurance that controls are in place to safeguard their confidential and sensitive data from loss or compromise. SOC2 accreditation provides exactly that. It’s a critical certification demonstrating that a managed service provider has the highest business operational standards and controls in place when it comes to five core trust principles. Those include security, availability, processing integrity, confidentiality, and privacy. And all of this is granted only after an impartial, third-party audit. This comprehensive audit will confirm that system controls have been put in place to block access by unauthorized users. An auditor might also look to ensure system availability is in-line with a service provider’s service level agreement and contract. Other assessments might evaluate disaster recovery methods, user access controls, and firewalls along with standards for the retention and disposal of personally identifiable information, among other important safeguards. Afterward, an auditor will develop reports that present detailed information on an organization’s security practices. Those reports can play a key role in organizational oversight, vendor management programs, regulatory oversight, internal corporate governance and risk management processes. Put simply, SOC2 accreditation is a crucial step in providing MSP partners with the assurance that their data is safe and secure. It's a level of assurance we, at American Digital, will always provide to our partners. In fact, since 2019, we’ve gone the extra mile to maintain our own SOC2 certification. Contact us today to learn more reasons why American Digital is the managed service partner of choice for some of today’s most discerning organizations.
By Daniella Lundsberg-Steele 15 Mar, 2023
Networks are continually strained by the demands of new hybrid workplaces, digital transformation, a move to the Edge, increasing numbers of connected devices such as phones and tablets, and new technologies like artificial intelligence and machine learning. Through it all, there’s a drive to maintain optimal network security, reliability, scale, speed, and compliance within tight budget constraints and limitations in existing IT resources and personnel who might lack certain skill sets. This leaves many organizations in reactive mode when, to be competitive, they need to be more proactive in driving ongoing business innovation. But a network-as-a-service (or NaaS) provider, such as HPE’s Aruba, can provide the advanced hardware, software, and services needed within a predictable subscription-based model. So you avoid long-term contracts and the high cost and commitment of infrastructure, paying only for what you use. NaaS also offers the flexibility to scale up or down to meet changing business demands. In some cases, NaaS also includes third-party network management delivered as a managed service. So companies can onboard the expertise, skills, and commitment of specialized networking personnel—expertise they might not have in-house. Additional perks include enhanced security, improved productivity, and proactive maintenance. And all of those benefits are supported as an operating expense. In the end, network-as-a-service helps you leverage the full potential of your network within a lean operational model while concentrating staff on core competencies that drive the business forward. Learn more at https://www.arubanetworks.com/video/?v=Products%20and%20Solutions/ARUBA-NAAS.mp4&width=960&height=540&t=Introducing%20Network%20as%20a%20Service
By Daniella Lundsberg-Steele 18 Feb, 2023
In our latest episode of the IT Unfiltered Podcast, Michael “MJ” Johnson, Director of SAP Solutions at American Digital, and Aiden Walden, Director of Public Cloud Architecture and Engineering at Fortinet, discussed some of the largest security threats they’ve noticed with SAP customers and what organizations can do to mitigate risk. During the broadcast, the two had an in-depth conversation on the changes that have been made within our modes of work, with access now granted to employees working from home and across various devices along with extranet and public connections that come into SAP and transmit things like purchase orders and invoicing. This combined with other factors have notably altered the threat landscape. But SAP customers can do a lot to guard against new threats. For instance, there are possibilities at the network layer to mitigate application-layer attacks, such as the implementation of virtual patching to fill that gap. Beyond this, consider a layered defense approach, with security established at various choke points coming into the infrastructure. Organizations also need a method for differentiating that traffic while still maintaining an optimized user experience. To this end, they’ll want to better understand benign anomalies versus malicious attempts. They’ll also want to identify security points that might protect applications in lieu of patching systems. One can filter a privilege escalation issue, for example, from contaminating one space to another. The two also discussed a more holistic approach to sealing gaps, one focused on business intent while aligning SAP Basis administration with network security. This type of approach offers a stronger security baseline understanding of each application and user. It also offers opportunities to prevent a privilege escalation that might allow one user to access an application and hop to the database. Furthermore, it might aid organizations with the implementation of more appropriate segmentation along with a policy framework that’s intelligent enough to identify application type and, if certain activity is abnormal, block it. This change in approach can be challenging in organizations that are more siloed in their processes and requires buy in from all teams. When it comes to SAP, a security policy shouldn’t be viewed as one-sized-fits-all but, instead, one that’s dependent on the applications that are being pushed into any given environment. It’s a policy that will need to adapt over the course of its lifecycle as the environment grows and as different factors come into play. We’ve seen some organizations adopt this way of thinking, and although this shift can be challenging to adopt, the entire organization benefits. Moving forward, great opportunities exist for applying deep learning and AI to the SAP environment, helping organizations continually fine-tune. Advances are also being made with operationalizing data, workflow automation, and threat hunting. American Digital and Fortinet are great resources for clients that need assistance with their security protocol. Tune into the full conversation by listening to the American Digital IT Unfiltered Podcast on your favorite podcast player.
By Daniella Lundsberg-Steele 06 Sep, 2022
Organizations today seek out hybrid SAP solutions that are capable of delivering the agility and economics of the cloud paired with the security and performance of IT on premise. But designing and implementing the right multi-layered solution can be complicated. It needs to suit your unique environment. It needs seamless deployment to ensure uninterrupted business continuity. And everything needs to be accomplished without over-burdening in-house resources. Consider the fact that numerous custom database management tools and data warehousing applications, whether on-premise or within any number of cloud providers, use critical business data that’s being housed within SAP HANA®. As those migrate to even larger SAP S/4HANA instances, they may not be suitable for public cloud due to application entanglement issues or data gravity. This can result in performance issues, data latency, and high egress fees. It’s no wonder many customers originally opting for SAP in public cloud are now repatriating critical infrastructure pieces to cloud adjacent solutions instead. In tapping American Digital with its almost 40-year track record spanning more than 200 successful SAP deployments, those same organizations can shift to SAP S/4HANA in the most cost efficient and reliable manner. Reason being, American Digital builds hybrid SAP solutions on secure and reliable platforms that guarantee predictable costs based on actual usage. They also provide single tenancy on SAP-certified infrastructure, cloud adjacent and globally distributed deployments, plus low latency connections to leading SAP ecosystem partners. And all of this is accomplished with the support of a trusted SAP partner. American Digital is the most experienced SAP solution provider, bringing the expertise needed to make deployment a successful reality. Contact us to learn more about how we leverage technology offerings .  From the industry leaders like HPE and Equinix to ensure your SAP environment runs smoothly and efficiently.
By Daniella Lundsberg-Steele 28 Aug, 2022
Enterprises love the cloud. It can broaden capabilities, improve flexibility, and put scalable resources at your fingertips. And while most applications and data are still housed on premise at data center colocations and at the edge, American Digital and HPE now provide organizations with the ability to enjoy one unified experience from edge to cloud. This experience is made possible by an exceptional tool from HPE that lets you engage with the cloud on your terms. As complete partners in data center modernization, American Digital and HPE work in tandem to help enterprises find the precise blend of cloud and on-premises solutions to suit their operational needs. Leveraging modern IT solutions like GreenLake, we can present endless opportunities across your edges, colos, and datacenters. In short, we help you realize a complete solution that can notably boost productivity—all designed and tailored to suit your own organizational needs. Now you can secure access to everything you need as-a-service and sized for today within an economical pay by consumption model. Beyond that, you’ll have the ability to manage all of your cloud services, onboard new users with defined roles and permissions, deploy virtual machines, forecast capacity needs, unify data across your hybrid cloud—even leverage artificial intelligence and machine learning—all through cloud-native infrastructure. American Digital is a recognized datacenter transformation leader. And we bring four decades of experience creating custom solutions for our clients, known for taking a client-first approach. As a result, we’re proud to have earned long-term client partnerships. Contact us today to discuss hybrid cloud solutions that combine the best of both American Digital and HPE.
By Daniella Lundsberg-Steele 02 Aug, 2022
The retail, hospitality, manufacturing, professional services, and education fields, among others, have set their sights on digital transformation and network modernization. In doing so, they’re looking to improve customer engagement, the user’s experience, and overall efficiencies. And Aruba ESP has been driving that change. Consider Homebase, a North American provider of multifamily and vacation rental connectivity along with what they’ve coined “Smart Living-as-a-service”. Using Aruba ESP, the company boosted property and operating income while shrinking the length of time building owners needed to manage unit turnover and maintenance tickets. Beyond this, Aruba ESP helps Homebase rapidly scale to accommodate a growing property portfolio. Meanwhile across the globe, Korean-based FASTFIVE, developer of a shared office space platform, chose Aruba ESP with Central plus Aruba Wi-Fi 6 and switching solutions to deliver innovative co-working experiences, accelerate business growth, and lock in a clear competitive advantage. Today, the company is reaping the rewards of proactive AI-powered network management along with the ability to support bandwidth-intensive applications like Extended Reality and video conferencing. Both primary and higher education have also tapped into Aruba ESP. Take Roseville Joint Union High School District, which has implemented the first-of-its-kind 180,000 square foot dynamic college-like collaborative learning environment. Likewise, Doane University recently rearchitected their network to enable always-on connectivity, remote and hybrid education, and network-generated contextual data and analytics. Within the retail industry, Aruba ESP has helped companies collect visitor data and push new services and promotions. Manufacturing, too, has used Aruba ESP to recovered millions of dollars by shrinking defects and inventory bottlenecks. Read more industry-specific case studies from companies now using Aruba ESP to drive digital acceleration and network modernization at https://www.arubanetworks.com/ebook/esp-customers /
Show More
Share by: