Scribd
Upload
35 views3 pages

SAP GRC EAM: Emergency Access Management

Enterprise Access Management (EAM) in SAP GRC provides controlled and auditable elevated access to production systems, focusing on emergency access management. Key components include Firefighter IDs, centralized configuration, and integration with Access Request Management, along with a defined workflow for FFID access. Best practices emphasize limited user assignments, training for controllers, and regular audits to ensure compliance and security.

Uploaded by

Madhu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
35 views3 pages

SAP GRC EAM: Emergency Access Management

Enterprise Access Management (EAM) in SAP GRC provides controlled and auditable elevated access to production systems, focusing on emergency access management. Key components include Firefighter IDs, centralized configuration, and integration with Access Request Management, along with a defined workflow for FFID access. Best practices emphasize limited user assignments, training for controllers, and regular audits to ensure compliance and security.

Uploaded by

Madhu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Enterprise Access Management (EAM)

in SAP GRC
1. Introduction
EAM is a component of SAP GRC Access Control that enables temporary, controlled, and
auditable elevated access to production systems. It addresses emergency access
management, ensuring transparency, security, and compliance.

2. Key EAM Objects and Configuration Steps


- Firefighter IDs (FFID):
- Technical user accounts with elevated access.
- Types: Owner (owns FFID), Controller (reviews logs), Firefighter (uses FFID).
- Created in target systems and maintained via /nGRCAC or NWBC.

- Centralized Configuration (SPRO Path):


SPRO → Governance, Risk and Compliance → Access Control → Maintain EAM
Configuration
Key configuration points:
- Plug-in system connections (trusted RFCs).
- FFID types and restrictions.
- Assign owners and controllers.

- Integration with CUP (Access Request Management):


- FFID assignment is workflow-controlled via ARM.
- Controlled through BRF+ decision tables.

3. Firefighter Access Workflow


Step Activity Tool/Transaction

1 Request FFID via Access NWBC → Access


Request Management

2 Approval routing (Manager, ARM Workflow


Owner, Controller)

3 FFID provisioned to user GRC Connector

4 User logs in via Firefighter NWBC / SAP GUI


Logon Pad
5 Session logs generated Audit Log Table

6 Controller reviews and NWBC or GRAC_SPM


approves logs

4. SAP Tables Relevant to EAM


Table Description

GRACFFLOG Stores firefighter session logs

GRACFFOBJECT FFID object assignment details

GRACFFUSER FFID and firefighter user mapping

GRACREQ Access request header

GRACREQPROVITEM Provisioning details for requests

5. Screenshots
• Screenshot 1: Firefighter Logon Pad interface

• Screenshot 2: Access Request form with FFID selection

• Screenshot 3: Controller Log Review dashboard

• Screenshot 4: SPRO configuration for EAM

6. Technical Tips & Examples


- Connector Configuration:
- Maintain trusted RFCs in SM59.
- Use SCOT for email notifications.

- User Exit Example: Enhance FFID provisioning logic via BAdI: GRAC_FIREFIGHTER_ID

- Log Archive: Use archive object GRAC_LOGS

- Common Errors:
- RFC not trusted: “Logon not possible.”
- Log not generated: Missing STAD authorization.
- No controller assigned: Workflow stuck.
7. Audit Considerations
- Review frequency: Weekly reviews recommended.

- Segregation of Duties (SoD): FFIDs should not conflict with SoD matrix.

- Retention period: Log retention defined in SPRO (default: 6 months).

8. Best Practices
- Assign limited users as Firefighters.

- Always configure alternate controllers.

- Train controllers on how to perform meaningful log reviews.

- Schedule background job /GRCPI/GRIA to sync usage data.

9. Conclusion
EAM is vital for compliant emergency access. It bridges the gap between operational
flexibility and control, provided it is implemented with proper workflows, reviews, and
monitoring.

You might also like