A security framework for an ERP system

This article provides an information security framework that can become an integrated process within an ERP system to support corporate governance. A generic information security framework serves as a starting point to develop a specific ERP security framework because most security managers are familiar with the framework. The generic information security framework consists of three components: people, policy and technology. These three components are extended and enhanced to better fit ERP systems. The ERP security framework is applied to an ERP model to illustrate how the three components can be incorporated into it. The ERP security framework guides management in integrating information security into the ERP system. This security framework is both product and vendor independent. The ERP security framework ensures that information security forms an integral part of the design, implementation and operation of an ERP system, so the information provided by the system is reliable.