Smartsoft Services

SAP security and GRC

Secure, auditable SAP landscapes across S/4HANA, BTP and SAP's cloud analytics, with least-privilege roles and clean segregation of duties.

We design and secure end-to-end SAP landscapes: ECC and S/4HANA (on-premise, private and public cloud), SAP BTP, SAP Analytics Cloud, SAP Datasphere and SAP Global Trade Services. Our senior SAP security consultants build least-privilege authorisation models, GRC-driven segregation-of-duties compliance and secure identity across hybrid estates, balancing control with delivery pace. We work with CISOs, auditors and programme sponsors, from first role design through to audit.

What we cover

  • Authorisation architecture

    PFCG and SU24/SU25; derived, composite and business roles; Fiori catalogues, spaces and pages; OData and CDS service authorisations

  • S/4HANA security

    Fiori Launchpad, CDS access controls (DCL), Business Partner, Central Finance, embedded EWM and TM, ECC-to-S/4HANA authorisation conversion, public cloud business roles and restrictions

  • GRC and compliance

    SAP GRC Access Control (ARA, ARM, EAM, BRM), SoD rulesets, emergency access, access certification; SOX, GDPR and ISO 27001

  • SAP BTP

    Subaccount governance, role collections and XSUAA, IAS trust, destinations, Cloud Connector, audit logging, Integration Suite and SAP Build security

  • SAP Analytics Cloud and Datasphere

    Roles, teams and scoped permissions, row-level security and data access controls, space isolation, data masking, SAML single sign-on, audit

  • SAP GTS

    Sanctioned party screening, customs and legal regulation authorisations, secure S/4HANA integration

  • Platform and identity

    NetWeaver, HANA, Gateway/ICF, RFC and trusted destinations, SAP Security Baseline, Patch Day; SAML 2.0, OAuth 2.0, Kerberos, X.509, SAP Cloud Identity Services, Entra ID, Okta, RISE with SAP

  • Detection and secure development

    Security Audit Log, SAP Enterprise Threat Detection, SIEM integration (Splunk, Sentinel), ABAP Test Cockpit and Code Vulnerability Analyzer

What we work towards

  • A role design that stays manageable, without role explosion
  • Fewer critical access conflicts and smoother SOX and ISO 27001 audits
  • Restrictions that carry through from S/4HANA into Datasphere and SAP Analytics Cloud
  • Secure single sign-on and monitored, hardened integrations

Frequently asked questions

Can you convert our ECC authorisations for S/4HANA?
Yes. We rebuild roles, Fiori catalogues, spaces and pages, and CDS access controls aligned to your business processes.
Do you work with RISE with SAP and S/4HANA Cloud?
Yes, including the shared-responsibility model and public cloud business roles and restrictions.
Can you help us prepare for an audit?
Yes: SoD rulesets, emergency access, access certification and complete audit trails.
Who delivers the SAP work?
SAP work is led by Junaid, our associate SAP consultant, and delivered with senior associate consultants, coordinated by Smartsoft, so you have one point of contact for the whole engagement.

Tell us about your system or your project.

We will reply with honest advice and a clear next step.

Request a quote Book a call