GDPdU: SE16_PERSONAL Field Report from Deutsche Post

Transcription

1 Service Niederlassung IT GDPdU: SE16_PERSONAL Field Report from Deutsche Post Maximilian Rumpf, Mannheim, June 10th, 2008

2 Agenda GDPdU Project Environment Project Goals Requirements for Z1 / Z2 Access Initial Situation and Decision Making Authorizations and User Roles for Z1 and Z2 in SAP R/3 Realization of Data Retrieval with PBS SE16_PERSONAL Usage experience with SE16_PERSONAL at the "Deutsche Post" Mannheim June 10th, 2008 Seite 2

3 GDPdU Project Environment Some Key Figures of Deutsche Post: Total Group Turnover (worldwide) in 2007: 63.5 Billion Euro In Germany: 25 Mrd. Euro EBIT 2007: 3.2 Billion Euro Employees wordwide: approx. 536,000 In Germany approx. 193,000 Project Environment at Shared Service Center Cologne Currently manages 50 Companies of DPWN (Deutsche Post World Net) Annual Posting Data: Approximate Amount of Double-Digit Billion Posted Invoices: Nearly Ten Million. System Environment: More than 10 GDPdU Relevant SAP ERP Systems Release Levels: from SAP 4.6 C to ERP 6.0 Mannheim June 10th, 2008 Seite 3

4 Project Goals Define the relevant SAP R/3 system(s) in FO, Germany together with tax authorities. Realisation of retrieval methods (database data and archive data) - Z1: Auditor has an own access to the system - Z2: An employee of DPWN accesses the system for the auditor - Z3: Generate data extracts from the system for the tax authority Define tax relevant customer-specific developments Define data which needs to be protected Define a regulation process for the external audit Keep consequential costs low Mannheim June 10th, 2008 Seite 4

5 Requirements for the Z1 / Z2 Access Basic prerequisites to enable Z1 / Z2 access: Read-only access limited to tax-relevant data for the auditor No access to protected data Avoid that auditors access dedicated data incidentally Role SAP_AUDITOR_TAX (with related roles for transactions and authorizations) Field catalog based on DSAG standard Enable logging for all activities Enable different types and hierarchies of authorizations (single roles, group roles, user menus, single profiles, group profiles) Mannheim June 10th, 2008 Seite 5

6 Initial Situation and Decision Making Scenario 1 SAP Database Z1 / Z2 / Z3 retrieval from database with SAP features Issue with missing limitations (e.g. TA SE16) Long residence periods long response time from DB Scenario 2 SAP Database Archive Z1 / Z2 / Z3 retrieval from database with SAP features Issue with missing limitations (e.g. TA SE16) Z3 retrieval from archived data needs huge efforts DART only with database data, rollback necessary Scenario 3 SAP + PBS Database Archive PBS Z1 / Z2 / Z3 retrieval from database via PBS Dedicated limitation is possible (PBS SE16_PERSONAL) Z1 / Z2 /Z3 retrieval from archive via PBS Easy access to archived data Extracts for non-sap access are possible Mannheim June 10th, 2008 Seite 6

7 Authorization and User Roles for Z1 and Z2 in SAP R/3 Authorization is separated by the following details: Time-based (e.g. access to data from to ) User-based (e.g user A is allowed to post data, user B can only read data) Data-based (e.g. only data of company code 1000 is accessible) Special attention shall be paid for SAP transactions SE16, SE16N and SE17. These enable table-based process analyses. PBS SE16_PERSONAL provides the following limitations: Allocation of table to individual users and user groups Limitation and default values for selection fields Select dedicated fields for the list display Configure table layouts with a special variant concept Mannheim June 10th, 2008 Seite 7

8 Realization of the Data Retrieval with PBS SE16_PERSONAL Variant Limitations: 1. Selection fields: Default values for valid value ranges 2. Limitation of field properties 3. Define fix default values 4. Maintenance of authorization objects Mannheim June 10th, 2008 Seite 8

9 1) Default Values for Selection Fields Dedicated selection fields can be filled with default values. The values can be customized and fixed with the administration transaction /PBS/SE16_PERSONAL Mannheim June 10th, 2008 Seite 9

10 2) Limitation of Field Properties Output fields: Output suppression (no display). Selection fields: Block fields for data entry. Mannheim June 10th, 2008 Seite 10

11 3) Fix Default Values When setting a default value and deactivating this field from the "selection field" list, you can lock the default value for a dedicated table variant. When using /PBS/SE16_PERSONAL for the corresponding table display, this locked value cannot be changed by the users. Mannheim June 10th, 2008 Seite 11

12 4) Maintain Authorization Objects The allocation of authorization objects and authorization fields ensures that access to application data and time periods for dedicated audits are checked. Mannheim June 10th, 2008 Seite 12

13 Usage of SE16_PERSONAL at Deutsche Post Currently, PBS SE16_PERSONAL is used: In three systems With more than 1000 tables which are classified to be tax-relevant. Planned usage of SE16_PERSONAL: Remaining GdPDU relevant systems Thus for additional x-thousand tables For DPWN employees when accessing tables for display within daily work Mannheim June 10th, 2008 Seite 13

14 Summary Q & A Mannheim June 10th, 2008 Seite 14

15 Thank you very much for your attention. Mannheim June 10th, 2008 Seite 15