Back in the day when I managed teams of BASIS and Security resources the challenge was always trying to convince the higher ups that more people were needed to man the pumps. Here are some musings on this challenge which may be relevant to more than just BASIS and Security.
My main challenge always was, that BASIS resources are generally more expensive than ABAP resources and often budgeting is based on a comparative analysis of those two roles. Even hiring a contract basis resource I typically saw ratios of 150% or more for BASIS resources. SAP Security were a little cheaper but they were still more expensive by at least 15 – 20%. There can be little doubt though that if you haven’t got BASIS and Security resources on tap, you can have challenges, far more than you have when you are down a couple of ABAPers.
Statistically speaking, a given BASIS resource is only available 90% of the time given that he/she must take a vacation sometime during the year. People get sick too, and though some people want to be as indispensible as they can be; who really wants sick people at work anyway? Then consider training. They probably attend TECHED or some industry conferences and perhaps skills training or mandatory weork training and that knocks another couple of weeks out of availability. Very soon you discover that that full-time resource is really only around 75% of the time. If you have a high velocity of project work and you don’t commit dedicated resources to projects then you are down a little more availability.
If you’re using permanent staffed BASIS resources then they are likely not hourly paid personnel and the reality is that expecting them to work more than 50 hours per week will likely land you in a situation where they will walk, irrespective of what you are paying them; in some countries you are regulated in just how many hours that person can walk without make up compensation too.
My experience in the US at least, is that you will need to talk to your personnel department but some sort of ‘comp’ time off usually helps to appease these guys but the harsh reality is that they will NOT be working a 40 hour week and when you hire someone into such a position that should be made quite clear. Having flexible work practices helps with keeping BASIS and Security personnel on board. This is especially true if the commute is a grunt and they don’t physically have to be on the premises. Many BASIS and Security folks I have spoke to in the field actually speak of elevated efficiency in their work practices if they have things to do and are not ‘trapped’ in office cubic-hell. if people don’t have to physically be in the office all the time and can work remotely that is usually a great advantage especially for off-hours work. Prescribing on site work for releases, major upgrades etc is not that big a deal I shouldn’t think especially if you have heart-burn about the quality of their domestic DSL or cable connection at home for remote work.
My experience, is that depending on the complexity of your technology stack you should consider dedicated resources with specific competency for ERP, CRM, APO, BI/BW. While many BASIS and Security resources have many strings to their bows in terms of cross application experience, there really is advantages over specialising even in this technical area. Skills in Archiving, TDMS, XI/PI and integration with other technologies all bring nuances that make it hard to find resources that have knowledge of all these area.
Additionally, if you have java components in addition to your ABAP stack then you may want to consider Java specific competency. Root cause analysis as any BASIS resource will tell you, is somewhat different to old school RCA in just the ABAP stack. Your choice is to either find multidisciplinarians for all technical areas (this may be a challenge) or you get people with some degree of specialization and this applies to both BASIS and Security.
If you have a geographically dispersed operation spanning multiple time zones (especially across the globe) and these are all SAP dependent then if there are support related requests, what is the SLA (Service Level Agreement) that you have established with the rest of IT and the business, for responding to and addressing those requests? If you have particularly aggressive SLA’s then you will need to ensure that you have coverage for all those timezones and in the realm of security in particular, a 4 hour onboarding SLA may not be easily met if your security team is based in India and you have no resources in North America to turn the issue around. So an SLA review may be in order in combination with staffinhg coverage plan.
If you have a number of projects in play, consider the level of effort required to services those projects from a BASIS and Security perspective. My experience is that you should have at least a minimum of 25% of each of these resources for the duration of the project but this factor can move higher, closer to go live and at planning and preparation stages. If you have high staffing turnover in the project then the requirement in the Security space may be higher. By all means make use of contract resources for this stage, because you can roll the cost into the project but also consider that you need time for documentation and knowledge transfer and often your operational BASIS and Security teams will want to be part of the planning process at the very least because they don’t want to inherit something deformed that was conceived by the project. My thoughts are that secondments out of the operations team are a better approach but this depends on how big your team is as a whole. Give consideration to your processes and controls for service and support requests in this area also. Get your project teams to behave like regular users in terms of getting security requests fulfilled in particular.
If you have a dedicated DBA who at least has some familiarity with the underlying database supporting SAP and how BASIS admins ‘manage’ the database in the BASIS layer, then that will help to some extent with any escalations. THe reasons this can be helpful is because you don’t need to throw all BASIS resources at a problem that is database related and this is particularly true when you are doing upgrades or archiving and/or backup related activities. The same applies to System Administrators (especially Unix). Part of your effort has to also be one of active education of the rest of your IT organization on what SAP is all about, who relies on it and how certain issues and topics are handled and again here, leveraging your BASIS and Security teams to educate other areas of IT and the business itself can have a tremendous benefit.
Finally, consider how sophisticated your system administration, alerting and monitoring is. You may have Solution Manager in place, but how instrumented is it? Do you have some enterprise monitoring in place, is it console enabled and dashboarded and how sophisticated is the alerting and threshold maintenance for errors and warnings? Also consider how you have classified your issues here and what actions need to be taken in what time frames relative to your SLA and extended support organization competency. Leveraging your enterprise job scheduling solutions together with Solution Manager and whatever you use for incident management can assist in reducing mean-time to repair and responsiveness of your teams to issues. In this vein also consider the relative maturity of your helpdesk, escalations and change management in general.
Password resets for example, should be handled by the helpdesk. User role assignment should be semi automated with tools like Virsa and wherever possible you should be automating the on-boarding and decommissioning of users.
If you can push at least some activities off to application management or sustainment for first and second level incident triage rather than to your BASIS and Security teams then this alleviates some of the pressure also and reduces your need for additional headcount.
My last thoughts on this topic are, consider some of the SAP services that you can leverage out of SAP Consulting and Active Global Support as well as third party consulting houses. The RUN SAP methodology doesn’t prescribe staffing ratios but the service can help you in identifying things that you aren’t doing but should be and these then become opportunities to open the door to further dialog with those who own the purse strings. Don’t forget to also engage in discourse with your peers in the industry. While they may not be exactly the same kinds of business as your own, they will give you a sense of how they are staffing to address the demands of their sector.
