Client success: Nikon gets the full picture of risks, with Soterion

So far, we have been doing SoD review in Excel. But at some point, we couldn't make the next step. We felt we were only touching the tip of the iceberg, and we knew there was much more risk in our system. So that's why we had to look for a mature, sophisticated GRC solution. We already were dealing with EPI-USE Labs for other tools and so we discussed the option to use Soterion. My name is Piet Jan Van Egdom. I work for Nikon Europe BV, currently in the Business Application Services team. The main challenge was we need to comply with the framework similar to the SOX framework in the US. For IT, it means we had to focus on two areas, change management, and SAP access control. We started the project where we established the connection between our SAP system and Soterion cloud. The module that we are using is called Basic Review; the Periodic Review, where the business has to review critical access and SoD risk; and we are using the self-service for password reset, which is going to save our first-line support a lot of time. We now see, in fact, for the first time, our real risk exposure, which was even higher than what we anticipated. So we're now able to fine-tune the risk profile on Soterion. So even after a few months already, you see the benefits that the tool has for us.

The challenge: Lack of visibility of their system’s risks

As the Nikon Corporation is listed on the Tokyo Stock Exchange, Nikon Europe BV – and the entire group – is required to be compliant with the J-SOX framework (also known as the Japanese Sarbanes-Oxley Act).

In an attempt to take a visual approach to their SoD (Segregation of Duties) risks, for the past ten years the IT team had been doing everything manually, exporting large amounts of data to Microsoft Excel to analyse SoD conflicts using SM20 log files.

The company realised that they were not getting the full picture, and were only able to skim the surface of their challenge. They needed to find a mature and sophisticated GRC (Governance, Risk and Compliance) solution to help them address compliance.

Tackling the risks with Soterion for GRC

Nikon Europe BV introduced SAP Access Control, and made a number of management changes. Having realised they needed additional tools to analyse and review critical access and SoD conflicts, they then implemented Soterion as their GRC solution for SAP systems.

As soon as they connected their SAP system to the Soterion cloud, they started to see tangible benefits in their risk management. Their risk exposure was even higher than anticipated, so they immediately started to mitigate the risks that Soterion highlighted.

They used the following Soterion modules:

Basis Review: to inspect their SAP Basis configuration against a set of rules based on industry best practices to establish full compliance.
Periodic Review Manager: which allows enterprise users to periodically review the access risk of their SAP users in their SAP systems easily and efficiently, to improve the visibility of their GRC environment.
Self-Service: for password reset services, which will save the team a lot of manual time in resetting and locking users’ passwords.