One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least integrating) data on different facets of business operations. Taking these claims at face value, how are ERP systems set up when a company such as a defence contractor carries out classified business?
The problem I'm imagining is that classified information could be infered from otherwise "boring" business data. For example:
- HR information on job title, location, or specialist qualifications held by staff could reveal the nature of classified work being carried out.
- Purchasing or Accounts Payable records could reveal sensitive subcontractor relationships or details of classified products the company develops.
- Even the company's Chart of Accounts could reveal the existence and size of otherwise unacknowledged projects.
I've never had to solve this problem myself, but I can think of a few ways an ERP system could support a company's conflicting obligations to safeguard classified information and to maintain detailed records for audit and management control:
- The system's built-in security features could be used to limit access to some data, while still allowing summary information to "roll up" to a safe level of aggregation (e.g. uncleared users might see a single GL account "Net classified income" with no further details). This would give cleared users or auditors an integrated view of the business, but has the disadvantage that anyone with privileged access to ERP data (system administrator, DBA etc) needs clearance.
- A separate classified instance of the system could be stood up, and all classified business recorded there - effectively the time-honoured accounting practice of running two sets of books. This would require a feed of unclassified summary data to the main system, which would treat the classified instance as one more external data provider. The obvious problem here is cost and keeping the two systems' configurations in sync.
- Classified data could be "hidden in plain sight", e.g. by using opaque project codes or account descriptions that don't give away sensitive information. This might work for job titles, but someone somewhere still needs to know that "Project X-123" is actually "Sharks With Frickin' Lasers" which seems to defeat the purpose of the system.
In general, how do ERP system implementations handle this situation?