{"id":8101,"date":"2022-10-05T11:48:28","date_gmt":"2022-10-05T09:48:28","guid":{"rendered":"http:\/\/inprosec.com\/?p=8101"},"modified":"2025-07-03T15:10:58","modified_gmt":"2025-07-03T13:10:58","slug":"case-study-implementation-of-sap-grc-access-control-at-sigma","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/","title":{"rendered":"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA"},"content":{"rendered":"<p><strong>The implementation of the SAP\u00ae GRC Access Control tool in the Sigma organization<\/strong> was the first implementation of SAP\u00ae GRC Access Control by Inprosec in Mexico. This implementation had a difference with respect to other SAP\u00ae GRC AC implementation cases since it was the first one in which the User Access Review (UAR) module was implemented to comply with the audit requirement for access recertification. The project had a duration of 5 months starting in November 2018 and would end in March 2019.<\/p>\n\n<p>Sigma is a <strong>Mexican multinational company<\/strong> involved in the production and distribution of refrigerated food. It is headquartered in the municipality of San Pedro, in the Metropolitan Zone of Monterrey, Nuevo Leon, Mexico. It has operations in more than 20 countries including Mexico, the United States and Europe.<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\" wp-image-8103 aligncenter\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-1.jpg\" alt=\"\" width=\"698\" height=\"185\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-1.jpg 1600w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-1-300x80.jpg 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-1-1024x271.jpg 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-1-600x159.jpg 600w\" sizes=\"(max-width: 698px) 100vw, 698px\" \/><\/p>\n<h2><strong>The Challenge<\/strong><\/h2>\n<p>The difficulty of the project was on the one hand to adapt the current process that was being used on a day-to-day basis at Sigma to the technology offered by the GRC system. This point is very important since <strong>we are not only talking about a technological change, but also included the need for an organizational or governance change<\/strong>. Another challenge that the project sought to cover was related to the role management process, where risk management was to be included in the process for the creation\/modification of roles.<\/p>\n<p>Sigma&#8217;s organization had a Risk Matrix that was being reviewed by an external audit. This matrix was the first step in the creation of Sigma&#8217;s Risk Matrix, which was a step forward in Sigma&#8217;s Risk Management.<\/p>\n<h2><strong>Inprosec Solution<\/strong><\/h2>\n<p><strong>Inprosec&#8217;s solution<\/strong> was to carry out a project dividing the phases according to the tool to be implemented:<\/p>\n<figure id=\"attachment_8114\" aria-describedby=\"caption-attachment-8114\" style=\"width: 697px\" class=\"wp-caption aligncenter\"><img decoding=\"async\" class=\"wp-image-8115 \" src=\"http:\/\/inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-2-e1664893342165.png\" alt=\"\" width=\"697\" height=\"184\" \/><figcaption id=\"caption-attachment-8114\" class=\"wp-caption-text\">Phase I &#8211; Access Risk Analysis<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_8112\" aria-describedby=\"caption-attachment-8112\" style=\"width: 697px\" class=\"wp-caption aligncenter\"><img decoding=\"async\" class=\" wp-image-8113\" src=\"http:\/\/inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-3-e1664893395549.png\" alt=\"\" width=\"697\" height=\"198\" \/><figcaption id=\"caption-attachment-8112\" class=\"wp-caption-text\">Phase II &#8211; Access Request Management<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_8110\" aria-describedby=\"caption-attachment-8110\" style=\"width: 698px\" class=\"wp-caption aligncenter\"><img decoding=\"async\" class=\" wp-image-8111\" src=\"http:\/\/inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-4-e1664893451299.png\" alt=\"\" width=\"698\" height=\"169\" \/><figcaption id=\"caption-attachment-8110\" class=\"wp-caption-text\">Phase III &#8211; Business Role Management<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<p>The Objectives\/Milestones sought for the <strong>first phase<\/strong> were:<\/p>\n<ul>\n<li>Updating the Risk Matrix to the latest version of the SAP\u00ae standard.<\/li>\n<li>Activation of Risk Alerts<\/li>\n<li>Analysis of Z Transactions to be included in the Risk Matrix.<\/li>\n<li>Creation of Compensating Controls<\/li>\n<li>Creation of Sigma Risk Matrix<\/li>\n<li>Stakeholder training.<\/li>\n<\/ul>\n<p>The Objectives\/Milestones sought for the <strong>second phase<\/strong> were:<\/p>\n<ul>\n<li>Configuration of &#8220;Workflows&#8221; for Creation, Modification, Deletion of Users in SAP\u00ae.<\/li>\n<li>Password Reset<\/li>\n<li>Access Request for Firefighters<\/li>\n<li>Roles Recertification (User Access Reviews).<\/li>\n<li>Stakeholder Training.<\/li>\n<\/ul>\n<p>The Objectives\/Milestones sought for the <strong>third phase<\/strong> were:<\/p>\n<ul>\n<li>Configuration of Workflows for Role Creation and Modification in SAP\u00ae.<\/li>\n<li>Mass Roles Upload (based on the new role model that was being implemented).<\/li>\n<li>Nomenclature Automation<\/li>\n<li>Training to interested parties.<\/li>\n<\/ul>\n<p>In relation to Phase I, a total of <strong>13 Risk Alerts were defined<\/strong>, <strong>focused on IT scenarios<\/strong> and which would communicate on a daily basis all the risks in which the execution of the Transactions involved in said risks would be confirmed. The option was marked that those users with an assigned compensating control would be excluded from such automatic communication.<\/p>\n<p>Another major tool that is frequently used in Sigma was the use of the <strong>standard SAP\u00ae Dashboard<\/strong> where all the details of users and risks existing in the Sigma organization can be identified:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-8109\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-5.png\" alt=\"\" width=\"698\" height=\"646\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-5.png 1004w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-5-300x278.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-5-600x555.png 600w\" sizes=\"(max-width: 698px) 100vw, 698px\" \/><\/p>\n<p>During Phase II, work was done on everything related to user provisioning. <strong>In order to allow greater flexibility throughout the provisioning process, a small form was created which, depending on the response<\/strong>, would progress through the process in one way or another.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-8117\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-8.png\" alt=\"\" width=\"698\" height=\"177\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-8.png 772w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-8-300x76.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-8-600x152.png 600w\" sizes=\"(max-width: 698px) 100vw, 698px\" \/><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\">The individual authorization option meant that access<strong> was only required for one user of the item.<\/strong><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">The authorize position option meant that access had to be given to <strong>all users who were part of the position<\/strong>, so this selection meant creating a BRM request for the position&#8217;s role maintenance.<\/li>\n<\/ol>\n<p>In addition to what had already been mentioned about ARM previously, Phase II also included the <strong>implementation of the User Access Review<\/strong> functionality that allowed to comply with the access recertification process that was being required by Audit. In the case of Sigma, and due to the fact that it was in the process of re-engineering the role model, this implementation was simpler since the recertification process would be executed only for the positions that had been approved for the time being:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-8107\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-6.png\" alt=\"\" width=\"570\" height=\"291\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-6.png 570w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-6-300x153.png 300w\" sizes=\"(max-width: 570px) 100vw, 570px\" \/><\/p>\n<p>Finally, during Phase III, the <strong>implementation of the Business Role Management tool<\/strong> was carried out, which allows creating and modifying roles in SAP\u00ae through SAP\u00ae GRC. A complete flow was established that could comply with the change management process that existed in Sigma:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-8105\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-7.png\" alt=\"\" width=\"686\" height=\"276\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-7.png 688w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-7-300x121.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP\u00ae-GRC-Access-Control-en-la-organizacion-de-Sigma-7-600x242.png 600w\" sizes=\"(max-width: 686px) 100vw, 686px\" \/><\/p>\n<p>We worked with a single active process in BRM and that allowed not only the design and creation of the role in the Development environment, but also allowed its transport to the Quality and Production systems aligning it with a process that supported change management. An important point was the <strong>deactivation of any kind of role deletion activity through BRM<\/strong> to avoid any kind of impact on the satellite systems connected to SAP\u00ae GRC Access Control.<\/p>\n<h2><strong>Results<\/strong><\/h2>\n<p>The implementation of the Access Control tool in Sigma was a success from several points of view: a <strong>risk matrix<\/strong> was activated that met the audit requirements and Sigma&#8217;s needs, an <strong>agile provisioning process<\/strong> was generated for user creations and modifications in SAP\u00ae, a role management process was implemented that included <strong>visibility of possible SoD risks that could be appearing as part of the creation\/maintenance process<\/strong>, an access recertification process was generated that met the audit objective. The project was completed within the timeframe established in the initial version of the plan and all the milestones established throughout the project were achieved.<\/p>\n<p>In relation to the technical part, it was the first time that we worked with a simple form to make the provisioning process more flexible, which has been used in subsequent implementations. We have worked with the User Access Review module and it has been proven that it is a tool that can fulfill the objective of access recertification as long as a correct selection of the roles to be reviewed is made (it is necessary to have a role model with approved positions).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The implementation of the SAP\u00ae GRC Access Control tool in the Sigma organization was the first implementation of SAP\u00ae GRC Access Control by Inprosec in Mexico. This implementation had a difference with respect to other SAP\u00ae GRC AC implementation cases since it was the first one in which the User Access Review (UAR) module was&#8230;<\/p>\n","protected":false},"author":6,"featured_media":13226,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[4,60,53],"tags":[149,151],"class_list":["post-8101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","category-sap-grc-en","category-success-stories","tag-access-control-en","tag-sap-grc-en"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.3 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA - Inprosec<\/title>\n<meta name=\"description\" content=\"The implementation of the SAP\u00ae GRC Access Control tool in Sigma&#039;s organization was the first implementation of this type that we did in Mexico. The project had a duration of 5 months starting in November 2018.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA\" \/>\n<meta property=\"og:description\" content=\"The implementation of the SAP\u00ae GRC Access Control tool in Sigma&#039;s organization was the first implementation of this type that we did in Mexico. The project had a duration of 5 months starting in November 2018.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2022-10-05T09:48:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-03T13:10:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP-GRC-AC-SIGMA-EN.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA\",\"datePublished\":\"2022-10-05T09:48:28+00:00\",\"dateModified\":\"2025-07-03T13:10:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/\"},\"wordCount\":1020,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/SAP-GRC-AC-SIGMA-EN.jpg\",\"keywords\":[\"Access Control\",\"SAP GRC\"],\"articleSection\":[\"General\",\"SAP GRC\",\"Success stories\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/\",\"name\":\"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/SAP-GRC-AC-SIGMA-EN.jpg\",\"datePublished\":\"2022-10-05T09:48:28+00:00\",\"dateModified\":\"2025-07-03T13:10:58+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"The implementation of the SAP\u00ae GRC Access Control tool in Sigma's organization was the first implementation of this type that we did in Mexico. The project had a duration of 5 months starting in November 2018.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/SAP-GRC-AC-SIGMA-EN.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/SAP-GRC-AC-SIGMA-EN.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/case-study-implementation-of-sap-grc-access-control-at-sigma\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA - Inprosec","description":"The implementation of the SAP\u00ae GRC Access Control tool in Sigma's organization was the first implementation of this type that we did in Mexico. The project had a duration of 5 months starting in November 2018.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/","og_locale":"en_US","og_type":"article","og_title":"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA","og_description":"The implementation of the SAP\u00ae GRC Access Control tool in Sigma's organization was the first implementation of this type that we did in Mexico. The project had a duration of 5 months starting in November 2018.","og_url":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/","og_site_name":"Inprosec","article_published_time":"2022-10-05T09:48:28+00:00","article_modified_time":"2025-07-03T13:10:58+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP-GRC-AC-SIGMA-EN.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA","datePublished":"2022-10-05T09:48:28+00:00","dateModified":"2025-07-03T13:10:58+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/"},"wordCount":1020,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP-GRC-AC-SIGMA-EN.jpg","keywords":["Access Control","SAP GRC"],"articleSection":["General","SAP GRC","Success stories"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/","url":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/","name":"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP-GRC-AC-SIGMA-EN.jpg","datePublished":"2022-10-05T09:48:28+00:00","dateModified":"2025-07-03T13:10:58+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"The implementation of the SAP\u00ae GRC Access Control tool in Sigma's organization was the first implementation of this type that we did in Mexico. The project had a duration of 5 months starting in November 2018.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP-GRC-AC-SIGMA-EN.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2022\/10\/SAP-GRC-AC-SIGMA-EN.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/case-study-implementation-of-sap-grc-access-control-at-sigma\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"Success Story: Implementation of SAP\u00ae GRC Access Control at SIGMA"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/8101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=8101"}],"version-history":[{"count":6,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/8101\/revisions"}],"predecessor-version":[{"id":13229,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/8101\/revisions\/13229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/13226"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=8101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=8101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=8101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}