GRC Firefighter strategy

[Former Member]

How many firefighter accounts are required if a customer has all modules of ECC implemented? Do firefigther accounts need to be SOD free?

[Former Member · Accepted solution]

Raj,

That is a function of variables such as the customer's risk appetite, how trusting they are of their SAP support team, and perhaps how finely delineated their support teams are. At my previous organization, they had only two flavors of FF, with HR and Without HR. I suspect that  it is more common to have one per module/ functional grouping.

Gretchen

[Colleen · Accepted solution]

You also need to consider log capture on building ff access

you don't want the ff ids to have too much access (eg non sensitive display) as transaction log will be massive. The ff controller won't want to sift through the results

number of accounts also depend on usage volume As only one person can use ff Id at a time

Raj - there's a few articles out on SCN for ff. your question is strategy and design. It will come down to your business requirement. There is not right answer here.

[Former Member]

Create FF ids by process area and give access relevent to the process.  FF ids need not be SOD compliant but work with the functional and technical teams to identify the requirements for the role(s).  Ensure that the FF id logs are being reviewed after each usage. 

[former_member197694]

Hello

As per my understanding,there is no standard strategy for FF implementation with respect to FF accounts,it is purely depends on customer business,users and functionality.

As suggested by John Rajan,create FF ids with respect to Business Process.So that it is easy to identify the approvers and controller.

BR

Baithi