Security for Military Data --- our Options -- Share your experiences

Question

Hi,
We want to secure military specific data in SAP.
We also want to comply with ITAR requirements.
One option is to create roles and profiles and then assign it to users who can view that data. In this approach the biggest problem is over head of maintaining 100's of profiles and roles. Our company does not have suffecient funds or team to do that.
Second option was to use development and here is how we envisioned it.
Maintain an indicator for foreign nationals in HR and also maintain an indicator for military personal in HR. (We are allready doing that, for some other busines process) So this table will tell us if an employee if foreign national or a military personal.
If Military person.
give access for military specifc data.
else.
error message.
endif.
similarly
if foreign national.
give error message.
esle.
let him view data
endif.
Now we are not sure if SAP has a common routine for authorizations, which we can change and add these conditions in it. (We will do core mod by getting access key).
If we follow this approach will we have to modify a single routine (for all SAP modules) for all master and transaction data transactions, or will it be multiple routines which we will have to modify.
We also need to cover authorization for table maintenence, transaction codes, org structure level...etc.
Can you please provide your inputs/point of view on this.
Will apprecaite if you can share any other option.
Thanks in advance.

Answer 1

Agreed with Wolfgang, roles & profiles are better in the long run than system mod.
There are ways to redesign roles to make them manageable. Example: Derived roles.
If you already maintain the users thru HR, you can assign roles in R/3 to Job, Position, Work Center, etc. Another idea to help you automated the roles assignment.
Regards,