SAP ECC Audit - Basis Application Infrastructure Security - Risk and Control Matrix & Testing Procedures for SAP ECC

SAP Audit Program - Basis Application Infrastructure (SAP ECC)

This SAP audit program has been designed to help audit, IT risk, compliance and security professionals facilitate the review of the Basis Application Infrastructure component in SAP ECC (SAP ERP Central Component). A brief overview and description of some of the key features of this audit program for SAP ECC:

This SAP audit program contains detailed testing procedures rather than generic description of the controls & the tests to be performed. You'll have step-by-step guidance on extracting configurable options (system parameters), user access listings and other reports from the system and testing SAP ECC application security controls
Audit program contains IT general controls (ITGC) process risks, related control objectives and control activities for the following key ITGC processes: operations, security, change management
Audit program can be used to ascertain compliance with the Section 404 of the Sarbanes-Oxley Act (SOX)
Can be used to help identify inherent risks related to SAP ERP security, minimize exposure to such risks, ensure that key controls are in place & operate effectively, and ascertain reliability of the SAP ECC Basis application infrastructure component.

Refer below for the table of contents. Also, please view an excerpt from the audit program to ensure it's right for you.

Audit Programs

View Excerpt

Table of Contents:

This SAP audit program contains 63 tests. The control framework has been specifically designed to help evaluate the adequacy and the effectiveness of the key configuration settings and access restriction mechanisms to a variety of sensitive basis transactions in SAP ECC, including:

SAP audit plan and testing procedures for auditing batch job and background session processing and administration functions:

Batch scheduling and batch processing authorizations in SAP ERP
Ability to administer background sessions in SAP ERP
Access to the batch input management functionality in SAP ERP
Monitoring procedures to identify processing errors and/or issues, etc.

SAP audit plan and testing procedures for auditing end-user authorization and administration functions in SAP ERP:

Segregation of user authorization and administration functions in SAP ERP
Access to maintain roles, authorizations and authorization profiles
Access to maintain the assignment of the authorization objects to transactions
Access to transport roles to production or activate roles in production
User master record maintenance in SAP ERP
Access to assign roles or profiles to users
Controls to ensure access to the SAP ERP system is authorized by management
Controls to ensure access to the SAP ERP is disabled for employees who no longer require such access, etc.

SAP audit program and testing procedures to assess the safeguards against unauthorized access to or modifications of programs and data:

Access to edit and execute programs online and in the background
Access to modify table content in SAP ERP , including critical systems tables or security tables and client-independent tables
Access to maintain SAP ERP Data Dictionary
Security of the custom tables, custom programs, and custom transactions, etc.

Audit plan and testing procedures to assess implementation and administration of the system configuration security settings:

Access to maintain/configure application server parameters
User access to maintain instances
CCMS Alert Monitoring
Configuration of the SAP ERP password parameters
Security of the vendor supplied user IDs
Access restriction to the powerful SAP ERP profiles (SAP_ALL, SAP_NEW, S_A.SYSTEM, S_A.ADMIN, S_USER_ALL, etc.)
Locking critical and sensitive transaction codes
Security of the remote access to/from the system, including interface communications, etc.

SAP audit program and testing procedures to assess change management and control:

System configuration to enforce appropriate change management process to prevent changes made directly in production
Ensuring that SAP ERP system landscape supports separation of production environment from development environment
Access policies over transports
Security of the SAP Software Change Registration (SSCR) developer keys and more.

Everything has been conveniently pre-documented with fill-in fields for company-specific information (entity name, date, data extracted from the system, etc.) which will allow you to proceed with your assessment immediately.

Please view an excerpt from the audit program to ensure it's right for you.

Price: $65.00 (Instant Download)