{"id":9434,"date":"2023-09-14T13:02:59","date_gmt":"2023-09-14T11:02:59","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=9434"},"modified":"2025-07-04T11:36:25","modified_gmt":"2025-07-04T09:36:25","slug":"implementation-sap-grc-access-control-vceaa","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/","title":{"rendered":"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA"},"content":{"rendered":"<p>Introducing one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. In this post, we will detail the configuration of all four modules (ARA &#8211; Access Risk Analysis; ARM &#8211; Access Request Management; EAM &#8211; Emergency Access Management; BRM &#8211; Business Role Management).<\/p>\n\n<p><a href=\"https:\/\/www.votorantimcimentos.es\/\">VCEAA<\/a> is the subsidiary of Votorantim Cimentos in Europe, Africa, and Asia. Votorantim Cimentos is among the top 10 largest cement companies globally.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-9429\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA.jpg\" alt=\"\" width=\"700\" height=\"336\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA.jpg 1247w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-300x144.jpg 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-1024x491.jpg 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-600x288.jpg 600w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<h2><strong>The Challenge<\/strong><\/h2>\n<p>The challenge in this project stemmed from two different directions. Firstly, the technological aspect, which came from the GRC tool, had a <strong>module for Role Management through SAP\u00ae GRC that hadn&#8217;t been implemented as frequently as other modules<\/strong>. Secondly, there was an organizational aspect where <strong>certain processes were not implemented organizationally<\/strong>. A new nomenclature for roles had been developed but wasn&#8217;t implemented across all systems. Additionally, the user onboarding, offboarding, and modification process in SAP\u00ae needed review to enhance security.<\/p>\n<p>Another challenge was to <strong>maximize the return on investment of the SAP\u00ae GRC Access Control<\/strong> <strong>License<\/strong> by utilizing the full potential of the tool to improve efficiency and security in user access processes within SAP\u00ae.<\/p>\n<h2><strong>Inprosec Solution<\/strong><\/h2>\n<p>It was decided to <strong>expand the functionalities of the existing GRC<\/strong>, which previously only had &#8220;Password Self Service&#8221; and access provisioning processes in Turkey. This expansion aimed to incorporate the use of EAM and BRM within the VCEAA organization and deploy ARM to the rest of the countries.<\/p>\n<p>Previously, the GRC system had a Segregation of Duties Risk Matrix and a user provisioning process for SAP\u00ae in Turkey. Key activities are detailed below:<\/p>\n<ul>\n<li>Implementation and Deployment of Mitigation Controls (ARA).<\/li>\n<li>Global Implementation of EAM.<\/li>\n<li>Global Implementation of ARM.<\/li>\n<li>Global Implementation of BRM.<\/li>\n<\/ul>\n<h3><strong>ARA \u2013 Access Risk Analysis<\/strong><\/h3>\n<div class=\"group w-full text-token-text-primary border-b border-black\/10 dark:border-gray-900\/50 bg-gray-50 dark:bg-[#444654]\" data-testid=\"conversation-turn-3\">\n<div class=\"p-4 justify-center text-base md:gap-6 md:py-6 m-auto\">\n<div class=\"flex flex-1 gap-4 text-base mx-auto md:gap-6 md:max-w-2xl lg:max-w-[38rem] xl:max-w-3xl }\">\n<div class=\"relative flex w-[calc(100%-50px)] flex-col gap-1 md:gap-3 lg:w-[calc(100%-115px)]\">\n<div class=\"flex flex-grow flex-col gap-3 max-w-full\">\n<div class=\"min-h-[20px] flex flex-col items-start gap-3 overflow-x-auto whitespace-pre-wrap break-words\">\n<div class=\"markdown prose w-full break-words dark:prose-invert light\">\n<p>The Access Risk Matrix in SAP\u00ae has been updated, expanding its monitoring scope from just 24 Segregation of Duties (SoD) Risks to 46, and additionally incorporating a total of 28 Critical Actions. The final Access Risk Matrix now looks as follows:<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-9431\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/tabla-VCEAA.png\" alt=\"\" width=\"651\" height=\"463\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/tabla-VCEAA.png 651w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/tabla-VCEAA-300x213.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/tabla-VCEAA-600x427.png 600w\" sizes=\"(max-width: 651px) 100vw, 651px\" \/><\/p>\n<p>Additionally, Z Transactions were added to the Final Access Risk Matrix, which were previously not monitored.<\/p>\n<h3><strong>EAM \u2013 Emergency Access Management<\/strong><\/h3>\n<p>The entire module was implemented, defining a global emergency access strategy shared across all VCEAA organization countries.<\/p>\n<p>There were 7 different emergency access scenarios, including IT access, SAP\u00ae OSS access, Security access, etc.<\/p>\n<p>The Firefighter Log Review Workflow was activated to ensure all accesses and modifications were reviewed.<\/p>\n<p>Statistics were gathered in the initial months, resulting in the following outcomes:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-9425\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-2.png\" alt=\"\" width=\"699\" height=\"396\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-2.png 600w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-2-300x170.png 300w\" sizes=\"(max-width: 699px) 100vw, 699px\" \/><\/p>\n<h3><strong>ARM \u2013 Access Request Management<\/strong><\/h3>\n<p>The implementation of the ARM module occurred in parallel with a Role Redesign project to improve the efficiency of the provisioning process. The provisioning process for user additions and modifications was as follows:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-9427\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-3.png\" alt=\"\" width=\"796\" height=\"317\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-3.png 1232w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-3-300x120.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-3-1024x408.png 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/Implementacion-SAP-GRC-Access-Control-VCEAA-3-600x239.png 600w\" sizes=\"(max-width: 796px) 100vw, 796px\" \/><\/p>\n<p>Additionally, as part of the ARM module, there was a functionality called &#8220;HR Triggers.&#8221; This application allowed for the automation of request creation processes based on changes made to the employee master data in SAP\u00ae HCM.<\/p>\n<p>The HR Triggers were specifically implemented for the termination process. So, when someone from the HR department recorded a termination, the GRC system automatically generated a request to lock the account in all SAP\u00ae systems where it existed.<\/p>\n<h3><strong>BRM \u2013 Business Role Management<\/strong><\/h3>\n<p>In this case, the challenge was more significant as it required not only a technological project but also the design and implementation of the Role Management process in SAP\u00ae. This meant that as the process was designed, the technological implementation of each stage was analyzed to ensure technical feasibility.<\/p>\n<p>A Role Management process was designed to align closely with the Change Management processes of large organizations, ensuring alignment with audit and security compliance requirements. The Role Management process involved positions like &#8220;SAP\u00ae Security Manager,&#8221; &#8220;IT Quality Manager,&#8221; and &#8220;Key User&#8221; (confirming user acceptance testing).<\/p>\n<h2><strong>Results<\/strong><\/h2>\n<p>All project challenges and objectives were met, <strong>significantly increasing the return on investment of the GRC Access Control License<\/strong>. The global perception that the GRC Access Control License only served to analyze Segregation of Duties Risks and Critical Actions was eliminated. This organizational change led to a continuous improvement dynamic, resulting in better system versions over time.<\/p>\n<p>As with any &#8220;Case Study&#8221; presentation at SAP\u00ae GRC events, it&#8217;s essential to highlight seven key points:<\/p>\n<ul>\n<li><strong>Estimate double the time for training.<\/strong>\n<ul>\n<li>This is a key point because it doesn&#8217;t matter if the best system in the world is implemented if users don&#8217;t know how to use it.<\/li>\n<\/ul>\n<\/li>\n<li><strong>A communication plan must be created for all project phases.<\/strong>\n<ul>\n<li>It&#8217;s important that this communication plan is aligned with the organization&#8217;s senior management to create the most favorable atmosphere for a technological project like the implementation of SAP\u00ae GRC Access Control.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Exercise caution with the deployment of EAM; it&#8217;s crucial to define a strategy before the technical implementation of the module.<\/strong>\n<ul>\n<li>Be cautious to avoid misuse of Firefighter access as it places an extra burden on log review tasks.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Implement all available activities in ARM for the account provisioning process in SAP\u00ae.<\/strong>\n<ul>\n<li>There are activities that serve for user lock and unlock, which can be useful in your organization.<\/li>\n<\/ul>\n<\/li>\n<li><strong>If the SAP\u00ae HCM system exists, consider implementing HR triggers.<\/strong>\n<ul>\n<li>They significantly reduce effort in tasks related to user terminations in SAP\u00ae and enhance the security of the process by involving only the HR department.<\/li>\n<\/ul>\n<\/li>\n<li><strong>It is recommended to use the standard reporting included in SAP\u00ae GRC.<\/strong>\n<ul>\n<li>There are highly visual reports on Access Risks and Provisioning Requests.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Invest time in understanding how BRM works.<\/strong>\n<ul>\n<li>This tool represents a change from the traditional way of creating and modifying roles in SAP\u00ae. It&#8217;s essential to understand its benefits and disadvantages to evaluate its implementation in your organization.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Invest time in understanding how BRM works, as it represents a shift from the traditional way of creating and modifying roles in SAP\u00ae, and you need to assess its benefits and disadvantages for your organization.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introducing one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. In this post, we will detail the configuration of all four modules (ARA &#8211; Access Risk Analysis; ARM &#8211; Access Request Management; EAM &#8211; Emergency Access Management; BRM &#8211; Business Role Management). VCEAA is the subsidiary of Votorantim Cimentos in Europe, Africa,&#8230;<\/p>\n","protected":false},"author":6,"featured_media":13289,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[60,53],"tags":[149,151],"class_list":["post-9434","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap-grc-en","category-success-stories","tag-access-control-en","tag-sap-grc-en"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.3 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA - Inprosec<\/title>\n<meta name=\"description\" content=\"Know one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. We will provide a detailed configuration of all its 4 modules: ARA-Access Risk Analysis; ARM-Access Request Management; EAM-Emergency Access Management; BRM-Business Role Management.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA\" \/>\n<meta property=\"og:description\" content=\"Know one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. We will provide a detailed configuration of all its 4 modules: ARA-Access Risk Analysis; ARM-Access Request Management; EAM-Emergency Access Management; BRM-Business Role Management.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-14T11:02:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-04T09:36:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/SAP-GRC-AC-VCEAA-EN.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA\",\"datePublished\":\"2023-09-14T11:02:59+00:00\",\"dateModified\":\"2025-07-04T09:36:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/\"},\"wordCount\":966,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/SAP-GRC-AC-VCEAA-EN.jpg\",\"keywords\":[\"Access Control\",\"SAP GRC\"],\"articleSection\":[\"SAP GRC\",\"Success stories\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/\",\"name\":\"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/SAP-GRC-AC-VCEAA-EN.jpg\",\"datePublished\":\"2023-09-14T11:02:59+00:00\",\"dateModified\":\"2025-07-04T09:36:25+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"Know one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. We will provide a detailed configuration of all its 4 modules: ARA-Access Risk Analysis; ARM-Access Request Management; EAM-Emergency Access Management; BRM-Business Role Management.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/SAP-GRC-AC-VCEAA-EN.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/SAP-GRC-AC-VCEAA-EN.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/implementation-sap-grc-access-control-vceaa\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA - Inprosec","description":"Know one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. We will provide a detailed configuration of all its 4 modules: ARA-Access Risk Analysis; ARM-Access Request Management; EAM-Emergency Access Management; BRM-Business Role Management.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/","og_locale":"en_US","og_type":"article","og_title":"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA","og_description":"Know one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. We will provide a detailed configuration of all its 4 modules: ARA-Access Risk Analysis; ARM-Access Request Management; EAM-Emergency Access Management; BRM-Business Role Management.","og_url":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/","og_site_name":"Inprosec","article_published_time":"2023-09-14T11:02:59+00:00","article_modified_time":"2025-07-04T09:36:25+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/SAP-GRC-AC-VCEAA-EN.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA","datePublished":"2023-09-14T11:02:59+00:00","dateModified":"2025-07-04T09:36:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/"},"wordCount":966,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/SAP-GRC-AC-VCEAA-EN.jpg","keywords":["Access Control","SAP GRC"],"articleSection":["SAP GRC","Success stories"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/","url":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/","name":"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/SAP-GRC-AC-VCEAA-EN.jpg","datePublished":"2023-09-14T11:02:59+00:00","dateModified":"2025-07-04T09:36:25+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"Know one of the first implementations of SAP\u00ae GRC Access Control at VCEAA. We will provide a detailed configuration of all its 4 modules: ARA-Access Risk Analysis; ARM-Access Request Management; EAM-Emergency Access Management; BRM-Business Role Management.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/SAP-GRC-AC-VCEAA-EN.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/09\/SAP-GRC-AC-VCEAA-EN.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/implementation-sap-grc-access-control-vceaa\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"Success Story: Implementation of SAP\u00ae GRC Access Control at VCEAA"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/9434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=9434"}],"version-history":[{"count":6,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/9434\/revisions"}],"predecessor-version":[{"id":12911,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/9434\/revisions\/12911"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/13289"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=9434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=9434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=9434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}