SAP HANA Analytics Foundation for SAP Solutions for GRC

There is an article in help.sap .com which talks about SAP HANA vs SAP GRC 10.0 , and they have nicely given the different reports we can get through HANA for Access Requests , Access Risks , Emergency Access

 Here are the details

Implementation Considerations : 

You install this software component as an add-on for SAP HANA. To use the virtual data model described in this documentation you need to run SAP GRC Access Control 10.0 or higher.

More Information : 

For more information about this product and a complete list of other add-ons available, see http://help.sap.com/hba.

You can access technical details for every view in the auto documentation. To create the auto documentation proceed as follows:

1.     In the SAP HANA Studio Modeler perspective, start Auto Documentation from the central frame.

2.     Choose the package and press Add.

3.     Enter a target location path and press Finish.

One PDF document for each view is created in the given path using the view names as file names.

Access Requests

 This virtual data model provides the prerequisites for analyzing the data generated during creation and processing of access requests. Based on this virtual data model, you can generate reports to answer the following business questions.

·         How many access requests were created for the last three months?

·         What types of access requests were created: User Access, reviews of Segregation of Duties, Emergency Access?

·         What was the length of time for the access requests to be completed for the last five months?

·         What access requests are still pending? How long have they been open?

·         How many users and roles were provisioned for the last four months?

·         What are the most frequently requested roles?

·         What are the service level agreements for the requests?

Access Risks:

 This virtual data model provides the (building blocks) prerequisites for creating ad hoc reports for analyzing the access risks, access risk violations, incidents of SoD risk and mitigating control risk violations, org rules, mitigating controls, actions, functions, critical actions/roles/profiles, action usage, incidents, Segregation of Duties (SoD) and user access risk. Analysis areas include risks library, rules library, users, roles

Based on this virtual data model, you can generate reports to answer the following business questions.

·         What are the access risk violations over the past six months?

·         What are the risk violations for a specific role?

·         What mitigating activities have been performed over the past three months?

·         What unmitigated risks exist in the system?

·         What is the history for SoD reviews?

·         What is the history for user access reviews?

Emergency Access

 This virtual data model provides the prerequisites for analyzing the data generated during emergency access and firefighting sessions. Based on this virtual data model, you can generate reports to answer the following business questions.

·         Who has performed emergency access activities for the past month?

·         What activities did they perform during the emergency access?

·         For what reasons did they perform emergency access?

·         What systems were accessed?

·         Who approved the emergency access?

·         What was the length of time emergency access was required?

 

" SAP GRC vs Other GRC Tools"

Last week when i was giving a seminar , there was a question from one of the audience that who all are the famous GRC vendors available in the market, then i asked him " What makes a software vendor’s product a GRC product?" , He started responding something, I asked him " how to differentiate among ERM, compliance applications and GRC "  the story went on....Later thought of compiling this list. 

What is GRC , What are all the GRC Products available in Market ? 

“Organizations are inundated with IT vendors claiming to have the answer for their risk and compliance problems. However, most of these vendors provide capabilities to meet only a single requirement or a handful of requirements and really are not a risk and compliance management vendor themselves. Real risk and compliance vendors provide a platform for documenting and overseeing risk and compliance across an organization.

 The fragmentation of the market and misleading terminology used in software vendors’ marketing makes it hard to identify “real” GRC vendors. For the moment the list below is based on companies mentioned in the Gartner Magic Quadrant for Enterprise Governance, Risk and Compliance Management.

SAP
The German business software company provides a diverse GRC suite.

CA
The provider of IT management software released its GRC Manager in September 2007.

IBM
IBM sells mostly third-party tools together with its own GRC contents and procedures.

IDS Scheer
The GRC platform of IDS Scheer is architected around the ARIS Risk & Compliance Manager.

MetricStream ( Now PWC have JV with this company in GRC Space)
MetricStream offers comprehensive services for audit, compliance, risk and policy management on its enterprise GRC platform.

Paisley
Founded in 1995, Paisley is one of the leading GRC software vendors with its products “Paisley Enterprise GRC” and “GRC on Demand”.  In 2009 it was acquired by Thomson Reuters, combining GRC technology with Thomson Reuters business information.

Protiviti
The risk and internal audit consulting company also offers software along with its services.

Rsam
Rsam is the d.b.a name for Relational Security Corporation and was founded 2003.

Wolters Kluwer
The Dutch company offers GRC services leveraging self-built products. In July 2009 they acquired GRC software competitor Axentis.

Other vendors

Sword Achiever
“Sword Achiever” is a unified GRC management solution that covers many GRC relevant areas.

Archer Technologies
Archer provides enterprise risk management and compliance solutions centered around its SmartSuite Framework.

Axentis
Axentis Enterprise is a portfolio of integrated GRC applications built upon a shared foundation of software services. In July 2009 Axentis was acquired by Wolters Kluwer.

BI International
BI International offers GRC capabilities on its Aline platform.

BWise
Building on a strong business process management heritage, BWise covers GRC with a variety of software products.

DoubleCheck
The DoubleCheck™ GRC & Audit Platform provides all four elements of a complete Enterprise GRC solution: Audit Management, Compliance Management, Risk Management and Policy Management.

Cerrix
Cerrix, which is part of the Dutch Artena group, offers a large set of GRC solutions.

Cura
This young software producer (founded in 2001) specialises on software for GRC.

DoubleCheck
The DoubleCheck GRC&T Enterprise Solution is a risk centric set of key modules that bridge the material requirements of Controls Framework Compliance to GRC Management with Controls Testing administration.

Difference between SAP GRC 5.3 and SAP GRC 10.0

Though it's not the right way to differentiate the two versions but here I have attempted to give some major differences for the beginners . 

	GRC 5.3	GRC 10
Naming Convention	SAP GRC Business objects Access control	SAP Access Control (from May 2012)
	Risk analysis and remediation	Access Risk Analysis
	Super user Privilege Management	Emergency Access
	Compliant User Provisioning	Access Request Management
	Enterprise Role Management	Business Role Management
Installation	Need to install on Java Stack	Need to install on ABAP Stack
End User Access	Any Browser ( Internet Explorer )	NWBC ( Netwever Business Client) Or Through Portal Browser
GRC Patch Installation	JSPM or SDM (/usr/sap///j2ee/JSPM/go.bat                      (Windows)	ABAP Stack ,  T-Code: SAINT
GRC Patches	VIRCC00_0.SCA - Risk Analysis and  Remediation  VIRAE00_0.SCA - Compliant User Provisioning  VIRRE00_0.SCA - Enterprise Role Manager  VIRFF00_0.SCA - Superuser Privilege Management  VIRACLP00_0.SCA - Launch Pad  VIREPRTA00_0.SCA - Enterprise Portal	Add-on patch GRCFND_A
Real Time Agents ( RTA)	VIRSANH  VIRSAHR	GRCPINW( Non HR) GRCPIERP (HR)
Features		Rich Set of new features available, Will be discussed in Next post