Microsoft Dynamics 365 Finance & Supply Chain Security Assessment and SoD Policy Development - 8 Week Assessment

Robust Security Design is a key factor when it comes to ensuring compliance – and keeping auditors happy. As auditors continue to increase scrutiny of Segregation of Duties and Sensitive Access risks, it is important that organizations implement a strong application security design to meet compliance requirements.

Protiviti has been consistently delivering on Security and Compliance solutions within Dynamics 365. With our extensive background in Internal Audit, we are experts in developing and maintaining an integral and conflict-free security design of the Dynamics 365 Finance and Supply Chain environment.

We provide Segregation of Duties and Security Access, enabling organizations to identify and mitigate the associated risks. We also provide further understanding of the overall security within the Microsoft Dynamics 365 system.

Objectives:

• Define the Segregation of Duties and Sensitive Access ruleset with input from business process owners
• Identify security risks at the user and security role level within Dynamics 365 Finance & Supply Chain
• Identify and document mitigating controls for all high-risk user SoD conflicts resulting from required role combinations
• Establish processes and ownership for maintaining the organization’s Security Governance rulesets

With a custom ruleset, we are able to provide client-specific security risks.

Activities to be Completed:

• Conduct a workshop with key Business Process Owners to discuss and update SoD and Sensitive Access rulesets and risk ranking definitions
• Receive data and input data into Protiviti Fastpath tool
• Gain a quick understanding of the client Dynamics 365 Finance & Supply Chain environment
• Perform SoD and Sensitive Access analysis
• Validate findings with the team
• Present observations and recommendations

Output:

• A SoD and Sensitive Analysis of Dynamics 365 Finance & Supply Chain Security Access
• Sensitive Access rulesets and risk ranking definitions
• Executive Summary Readout with observations and recommendations
• Roadmap detailing next steps

The cost associated with the activity is highly dependent on number of users and roles – and can only be truly determined on case-to-case basis.