DEMO – SmartGrc

Order a Demo

SAP S/4 HANA Security – Check List – Trial Version

The purpose of the SAP S/4 Hana application security check list document is to provide a comprehensive framework for evaluating and ensuring the application security of SAP S/4 Hana systems is in place and is in good standing according to best practice and industry standards.

1. Is there a GRC tool implemented to facilitate the automatic provisioning of user access?

Yes No

Additional Comment

2. Is there a defined procedure in place to address situations where critical access or high segregation of duties risks are identified on access requests?

Yes No

Additional Comment

3. Is there a procedure for promptly revoking access for users who no longer require it, such as when they change roles or leave the organization?

Yes No

Additional Comment

4. Is the identity of users with Super User or emergency access verified?

Yes No

Additional Comment

5. Are there methods implemented to monitor the activities of users with elevated access?

Yes No

Additional Comment

6. Are there triggers identified for revoking elevated access? What are these triggers?

Yes No

Additional Comment

7. Are regular reviews conducted regarding Super User or emergency access? What are the criteria that are used to assess the adequacy of such access?

Yes No

Additional Comment

8. Are the roles created within the principle of “minimum access required”?

Yes No

Additional Comment

9. Are user access requests reviewed to ensure compliance with SoD policies before approval?

Yes No

Additional Comment

10. Is there a process for retiring roles that are no longer needed or relevant?

Yes No

Additional Comment

11. Is the training mandatory to obtain requested roles?

Yes No

Additional Comment

12. Are SoD rules defined to prevent conflicts of interest or fraudulent activities?

Yes No

Additional Comment

13. Are automated reports generated to identify and investigate SoD violations on a regular basis?

Yes No

Additional Comment

14. Are mitigation controls implemented to reduce the risk of SoD violations to an acceptable level?

Yes No

Additional Comment

15. Are secure coding standards and guidelines established and followed for custom developments?

Yes No

Additional Comment

16. Are custom developments tested to ensure they respect SAP authorization concepts and do not bypass security controls?

Yes No

Additional Comment

17. Is there a process to conduct security audits of custom developments to ensure compliance with security policies?

Yes No

Additional Comment

18. Is there a documented policy for periodic user access reviews in SAP?

Yes No

Additional Comment

19. Is there a process to promptly revoke access for users who no longer require it?

Yes No

Additional Comment

20. Are procedures established for conducting regular user access reviews?

Yes No

Additional Comment

Run SAP Security Assessment

Fill out the form below, and we will be in touch shortly.