KuppingerCole Leadership Compass: Access Control Solutions for SAP and Other Business Applications

⇨ Access control solutions for SAP environments are essential for managing risks, ensuring compliance, and protecting critical business applications.

⇨ The market for these solutions includes specialized vendors with deep integration into SAP environments, as well as larger players and vendors from the Identity and Access Governance (IAG) space.

⇨ Selecting the right vendor requires a thorough evaluation based on specific criteria and may include a proof of concept phase to ensure the solution meets the organization's needs.

Introduction / Executive Summary

Leadership Compass for many enterprises, SAP systems are an essential part of their corporate IT infrastructure. Critical business information is stored within ERP systems, and the favored source for employee data is the SAP HR system. Business processes are implemented through portal solutions relying on SAP infrastructure. Data is held in SAP HANA; the migration to S/4HANA is ongoing, and highly individualized functionality is coded right into the existing standard SAP modules by using ABAP or Java.

Although there are many other systems in place which also contain critical information, many businesses still rely on the availability of well-designed and well-protected SAP Systems. Traditionally, SAP systems are a major focus area for internal and external auditors. For the successful implementation of adequate controls, it is essential that all existing SAP systems are covered by an effective solution for managing risks, and within that for managing access control and SoD controls and implementing adequate Access Governance.

SAP solutions remain at the core of the LoB infrastructure of many organizations. Managing access entitlements including roles, but also SoD (Segregation of Duties) rules, firefighter access, and other aspects around identity, access, and security is essential for protecting these business-critical applications.

Many critical business systems are following the trend of shifting to the cloud, using either solutions provided by SAP such as SuccessFactors or Ariba, or to other vendors’ solutions, SAP systems remain at the core of the LoB (Line of Business) application infrastructure of many organizations. While the scope for managing access controls is expanding beyond the traditional ABAP systems and even beyond SAP, these systems are of high criticality for many organizations.

This Leadership Compass focuses on the support for the SAP environment, while a separate document takes a broader perspective across a heterogeneous LoB landscape.

Highlights

• While the customer requirements for access control solutions for their business applications are expanding in the context of the journey towards SaaS services, many organizations still build their LoB infrastructure primarily on traditional and modern SAP solutions, operated both on premises and in the cloud
• Customers that continue to focus on their traditional SAP environments, with the SAP department being the buyer, commonly look for deep integration into these environments and familiar user interfaces