How is your company managing cybersecurity when working with  tools that work on top of your core ERP? e.g visualization, control towers,  decision making tools etc..

Outsourcing policy, Information security policy and Data Governance policy are 3 high-level guidelines to ensure risks are managed appropriately  

For us (internally at our firm) we start with a data governance policy that spells out in detail what type of information that each person (or role) within the firm is able to see across all applications and platforms. That enforcement starts at the core system of record which for us is our ERP and HCM platform; our scheduling system; and our service delivery platform. Least privilege access is enforced at those endpoints.

For there, that policy guides all access across all systems and when our BI team creates reports and connections, access rights are pulled from those primary tools and enforced such that when the BI tool is able to generate advanced reporting based on the data, those reports are limited to the people that had access to the underlying systems in the first place and that access cannot not be circumvented through the use of the BI SaaS tool.

The danger comes when companies start using privileged system accounts to pull data into a BI/visualization platform and the resume is access to individuals that were otherwise unauthorized.