This podcast features industry professionals from SAP Concur and Genesis Consulting, discussing current obstacles utility departments face, such as more frequent extreme weather events that strain field operations and require rapid crew mobilization across sprawling service territory. Hear speakers talk about possible solutions for resilient finance operations and why regulators are demanding improved documentation for utility defenses. Access the podcast to learn how utilities can prepare for increasingly sophisticated cyberattacks on critical grid infrastructure. Explore how your organization can strengthen finance operations for grid and cyber disruptions, automate accounts payable and invoice-processing workflows and enhance visibility and financial control. Listen to the podcast to learn how your organization can build resilient, business-continuous finance operations.
Anthony Jimenez
Welcome back to Carahcast, the podcast from Carahsoft, the trusted government IT solutions provider. Subscribe to get the latest technology updates in the public sector. I'm Anthony Jimenez, your host from the Carahsoft production team.
On behalf of SAP Concur, we would like to welcome you to today's podcast, focused on current obstacles utility departments face, such as more frequent extreme weather events that constrain field operations and require rapid crew mobilization across sprawling service territory. Mark Block, delivery lead, and Tim Martino, principal cybersecurity solutions advisor, will discuss how your organization can build resilient business continuous finance operations.
Megan Billingsley
Welcome to today's webinar, when the grid goes down, will your finance operations hold up? We're excited you could join us. My name is Megan Billingsley, and I'll be moderating today's event.
The threats facing utilities today are unlike anything they've ever faced. Extreme weather events are becoming more frequent and severe, straining field operations and requiring rapid crew mobilization across sprawling service territories. At the same time, cyber attacks on critical grid infrastructure are increasingly frequent and sophisticated.
As a result, regulators are demanding improved documentation about utility defenses. Most utilities have invested heavily in grid hardening, customer communications and emergency response and cybersecurity frameworks. But financial operations, that gap remains largely unaddressed.
And when regulators, insurers, and rate case auditors come looking for documentation, the organizations that cannot produce clean, audit-ready cost data will face the consequences long after the outage is over. This webinar will challenge a common assumption that modernizing financial operations is an administrative back office project. It is not.
It is a strategic investment that determines how fast you mobilize field crews, how confidently you respond to regulators, and how securely your financial data holds up against the same threat actors targeting your grid. We are fortunate to be joined today by two great speakers. With us are Mark Block, SAP Concur Delivery Lead, Genesis Consulting, and Tim Martino, Principal Cybersecurity Solutions Advisor, SAP Concur.
Before we get started, I have just a few housekeeping items. Please note the slides will advance automatically throughout the presentation. To enlarge the slides, click the Enlarge Slides button located in the top right corner of your presentation window.
If you need technical assistance, click on the Help widget located on the bottom left corner of your console. We encourage you to submit questions at any time throughout the presentation using the Q&A widget at the bottom of your console. We will try to answer these during the webcast, but if a fuller answer is needed or we run out of time, it will be answered later via email.
Please know we do capture all questions. So to kick off, I'd like to ask each of our speakers to provide a quick introduction of themselves and their work. Mark, how about you start?
Mark Block
Thank you. Good afternoon. My name is Mark Block.
I'm with Genesis Consulting. We are a consulting firm based in Western Virginia, and I lead our SAP Concur delivery through practice. And we work primarily in the public sector and regulated industries, and my background is in project management and business systems analyst primarily for financial information systems with about the last 15 years focused on travel expense solutions, specifically SAP Concur.
Thank you.
Megan Billingsley
Excellent. Thank you. And Tim, can you introduce yourself?
Tim Martino
Absolutely. So my name is Tim Martino, and I'm a Principal Cybersecurity Solution Advisor here at SAP Concur. SAP Concur delivers travel and expense solutions for our customers across a broad range of industries.
So I've been with SAP Concur for 26 years, and the last eight-plus years have been focused on our regulated industries. So I cover clients that look at SAP Concur that are in the utility space as well as federal, state, local, higher ed, and defense contracting. And I typically speak to CISOs and IT architects, risk officers, and compliance and finance folks around data exchange, data protection, and the security of data.
And, you know, really the points that and topics we'll be covering today is stuff I'll talk about. So thank you.
Megan Billingsley
Excellent. Thank you both for taking the time to be with us today. So with that, let's jump into our discussion.
Mark, I'd like to start with you. When people think about outage response, they focus on crew deployment, customer communication, and resources, but not usually reimbursement. Why is reimbursement critical to effective outage response?
Mark Block
Thank you. It's a good question, and I think we've all seen in the news, you know, when there's a period of a natural disaster, and you see on the television station where they have lines of trucks heading off to a distant city or distant state to support. And, you know, one of the things that's often, you know, not discussed is how are those crews, you know, going to be fed, and how are they going to be housed, and how are they going to get the funding they need?
Because a lot of times when they head off on those type of engagements, you know, they could be gone two days. They could be gone two weeks. It all depends on the severity.
They really don't know until they arrive on site. So, you know, if they don't have money, and they're not sure, how am I going to pay for my meals? How am I lodging and going to be accounted for?
That's going to be distraction. You know, and with these crews that have very technical expertise, whether it's hydroelectric or power generation or literally, you know, climbing the lines to restore power, you know, they need to be focused on safety and focused on doing their job right. So we want to make sure that we see distractions are possible.
And really, it just pulls down to the bottom line, you know, is we just need to make sure that giving them the funds they need during an outage is focused and it's not a distraction. Again, you don't want them waiting on those, you know, those lines of crews in the new stations there and saying, well, why haven't you left yet? Well, I'm waiting for that check, that paper check, you know, to be able to pay for my lodging.
We don't want that to be a non-issue.
Megan Billingsley
So clearly, then reimbursement matters. Mark, what does it look like when it's processed manually?
Mark Block
So we're working with a client today to implement SAP Concur. They're a large municipal utility. And one of the processes that we're working to address with the implementation of their Concur solution is today, you know, this particular utility, they have some very remote locations.
And if someone's going to go out for an extended outage or even maintenance that they could be gone, they actually have to come into an office site and get a paper check and then, you know, stop by and get that either. Maybe they'll use mobile deposit, but they have to get that funds into their account so they can fund their trip. And part of that gets to be the challenge is, you know, this particular utility, they have, I think, 11 different collective bargaining units.
So each one of those collective bargaining units can have different criteria on the amount of the reimbursements or how they are, you know, what's funded via the reimbursement versus what should be direct billed. So those are all challenges that when you have someone to generate those amounts manually, it becomes very tedious and very error prone. And again, so with all those collecting bargaining events or collecting bargaining units combined with those huge events where they might send 10 or 20 trucks out, it just exponentially increases the complexity of not just those technicians, but also the support staff making sure that the funding is accurate and it gets to the technicians as quickly as possible.
And even though, you know, and I've talked a little bit about emergency situations because those kind of seem to get the most headlines, but there's also very legitimate things where they may have remote locations and they may need, even in a planned event, it can still be a hassle trying to figure out, OK, where's my funding going to come? How am I going to get the funds into my account to make sure I can pay for my meals when I get on site? So it just it doesn't take a whole lot of planning, but it does take a lot of extra cycles or extra effort to get all that funding in place.
Megan Billingsley
Could you talk a bit more about the problems that a manual approach causes in more day to day scenarios?
Mark Block
Yeah, it's really it's very labor intensive and it's also error prone. You know, it takes time, you know, from the employees from traveling and then it pulls the administrative staff, you know, the administrative staff in an outage or a crisis situation. You know, they've got extra responsibilities that they're now handling.
They've put a lot of their day job aside to focus on on the emergency response. And even those those administrative staff, you know, that have to do a lot of the funneling, they might have to go out and, you know, sometimes deliver, I've heard, deliver checks to a site to make sure that employees have the money they need and extend it out. So it doesn't just impact the technicians, but it impacts all the support staff to make sure that those those technicians, those the electricians, that they have the information and the funding they need to continue focusing on the repair situation.
Megan Billingsley
Excellent, thank you. Mark, could you give us a concrete example of what these manual process challenges look like in practice? So I know you've worked with utilities like Seattle City Light and Southern California Edison.
So what are some real world consequences you've seen?
Mark Block
Certainly, you know, it's some of these things, you know, when it comes to calculating expenses, you know, thanks to they can be very complicated. You know, an example is, you know, crew has to leave North Carolina and they're going up to northern Virginia, the greater District of Columbia area. And the complexities behind calculating those meals that actually it's surprising how complex it can be.
So, for example, if you're staying in Arlington, but you're working Alexandria, Virginia, you know, they have different reimbursement rates. And how do you know which one to apply? And again, if you're relying on someone that's that's like an administrative staff that does not familiar with that area, they might make an error on the amount of those calculations, which could result in overfunding or significant underfunding of the trip based on the specific location.
And so, again, it's a manual entry that creates the opportunity inadvertently as it might be for errors, which impacts the travelers or the utility workers. And, you know, again, if you if you over advance too much funds, you know, we've all seen it. It can sometimes take weeks to get all that funding pulled back.
And, you know, you can't necessarily, you know, withhold that that amount from their paycheck. You know, that's part of the bargaining agreement. So you've got to just extra administrative work to track down those overpayments and get those back and do that full reconciliation.
You know, as I mentioned, you mentioned Seattle City Light. You know, these are these are crews that they might drive two or three hours to very remote areas in the boundary, in the boundary waters area, boundary waters and the boundary with Canada and where they could travel four or five hours to a very remote location where even cell service can be spotty. So you need to make sure that when they're in those kind of scenarios that they have the funding they need for those trips to make sure that it's on its direction.
Megan Billingsley
Yeah, absolutely. Mark, you work with utilities to leverage automation and other capabilities that Concur provides. We've heard about what manual processes involve.
What does it look like on the flip side when processes are automated?
Mark Block
Well, you know, I almost want to say if we all remember that old Staples easy button that you can hit. So it's not quite there, but it is it is amazing with just a little bit of configuration. And, you know, think about, for example, per diem rates.
You know, the GSA does the work of addressing those as a baseline. But then if as you as if you have collecting bargaining agreements, sometimes those have different rate reimbursements. You know, some might have expenses that are allowed in your collective bargaining agreement there, but they're not allowed in a GSA approach per diem approach.
So you can load all those rate structures into SAP Concur. And then you can also by identifying the resource, OK, this resource, this technician is part of this labor union. Therefore, they apply this specific bargaining agreement reimbursement rates is what they should be using.
So Concur will do all that automatically. It'll read, you know, what the employee, what their collective bargaining is, and then use that data driven coming off of their employee profile to drive the labor rates if they have something outside of GSA per diem. And it's just it just simplifies that.
And really, once that data is all loaded and maintained by someone else, you literally just have to put in the dates you're going to travel, where your destination is, and the system is going to automatically calculate all of those activities. Now, another benefit is when it comes to the funding side. You know, I remember, you know, when I started traveling for business, we'll just say 30 years ago, you know, you had to submit all the paperwork of what you were going to travel.
And then when you were done, you had to, you know, tape all of the receipts onto a piece of paper. Then you put it send off in inter-office mail. And then eventually you might get a reimbursement, a paper reimbursement check.
Well, nowadays, by using a program such as SAP Concur, not only do you make sure they get the targeted correct amounts for the travel, but anything that's that's that the additional money that they spent over the that was over that, they can submit an expense report that's going to automatically be reimbursed into their bank account, whether it's on a payment cycle or part of their their their paycheck cycle. So, again, we've done away with waiting for paper checks.
At Concur, by using things such as a cash advance feature, you can get money deposited into their into the traveler's account the same day. I mean, we have utilities that they run. They run those cash advance cycles every single hour because they know there could be a scenario where someone needs fund right away.
So instead of having to go out and do a manual kickoff of a check run by automating that in SAP Concur, you're going to make sure that on a regular basis throughout the day that employees that need that cash advance, they're going to get it funded automatically. And it's one less thing for them to worry about. Another benefit really goes into the back end reconciliation.
Once the trip is done, you still got to come up with that account for that money. And that's where reporting and reconciliation is really facilitated by SAP Concur. There's a lot of pre-built reports out there, a lot of reconciliation and auto reports that you can look at again.
And you can also use those some of that same reports to look at, you know, how is my spend? Where am I spending the most amount of money? And you can use that to drive budget decisions on do I need to increase, you know, travel or operational expenses because specific areas, you know, we had a higher than expected outage, outage ratio in a specific geographical location that perhaps had our highest reimbursement rates.
So do I need for budget planning for next year? Do I need to increase the amount of that allocation? Just all that data comes automatically from SAP Concur.
And again, it just makes it, as I mentioned a minute ago, facilitates the reimbursement process or the cash advance process for the technicians and the field crews. The other thing, just lastly, is I kind of touched on this earlier a minute ago, but all that data is preloaded in SAP Concur. So negotiated rates, preferred suppliers, that's all handled through Concur, so it's no manual calculations.
There's no looking something up in a contract to find out how to apply. It's all done automatically in the system.
Megan Billingsley
Fantastic. Thank you so much. Now, Mark, you've worked on many Concur deployments.
So what's the difference between smooth deployments that deliver benefits to field crews and administrators and those that struggle?
Mark Block
You know, I really think it boils down to change management. I mean, and I've seen this where one of my things I hold very close is that you can have a perfectly configured system that meets all your operational and business and technical requirements. But if your end users are not properly trained, the implementation can fall flat on its face.
So that's where we really structure on making sure that the organizational change management component of a project is just as critical as making sure that the widgets or the system is configured correctly. You know, and this gets into, again, it impacts the technicians as well. For example, if utility, there's a lot of things that when you talk about a change in an expense process, there's a lot of noise, a lot of background worry that starts happening.
OK, well, I'm having my trip, you know, I'm generating my trip request in one product. Now I'm switching to Concur. How am I going to make sure that I get the funding or that the reconciliation between my trip request and my expense report is matched together?
So those are all things that some of the infrequent traveler or someone that travels on a regular basis, well, they they don't really care about it because they know it's going to be automatically reconciled, you know, because they're using a corporate card. But for individuals that don't travel as much or don't have that luxury of that, that corporate credit card, it actually starts to predominate and cause a lot of anxiety among the traveler, among the individual technicians, which in turn, you know, that gets moved upwards. So the next thing we know, we've got senior managers expressing concerns on departmental calls that their employees don't know what's going to happen with this cutover of a new travel expense system.
So the key that we look at is identifying and building a good change agents. You know, it's recognizing that when you're looking at change management, you shouldn't just be talking to the road warriors of the organization that sometimes travel three or three out of four weeks a month, but it's because they might have the more corporate visibility because they're in the office more. But it's those field technicians that are going out and doing the line work, doing the electrical work on a dam that they have feedback and that they are involved in representatives and that change agent as well to make sure their needs are addressed.
An example of that is with the client. You know, what we're doing is we're setting up remote, you know, it's remote instructor led training for the corporate staff, but for those remote sites that are primarily composed of technicians, you know, field crews, we're actually sending somebody on site to their locations. You know, they can spend one week in one location, another week in a different location where they are there and dedicated that whole week, not just to train the travelers or those technicians, but also train the administrative and support staff to make sure they have extra understanding of why the system was configured away so that when when their technicians come to them with questions, they're able to do kind of like a first call resolution. OK, well, here's why you have to do it that way instead of having to then funnel the call back up to the departmental AP group.
So that's just really where, again, it's making sure that the system is not just configured, but the employees are trained and that they have the knowledge and they have the comfort level that they that the solution is going to provide them, you know, the funding and the reimbursements that they need.
Megan Billingsley
Yeah, really great points. One more question for you, Mark, before we bring Tim into the conversation, are financial systems truly mission critical for utilities managing field expenses during outages?
Mark Block
You know, I think they are. I've I've worked with a few years ago, I've worked with the CIO in the private sector. And, you know, we're talking about disaster recovery.
And, you know, he was asking, well, what's you tell me about Concur's disaster recovery protocol? But then we focus on, well, let's talk about disaster recovery for your organization. And he was he basically said, you know what, if there's if if my if there's a cyber attack or something in our our ERP is down for two weeks or severely constrained because of technical problems, you know, I mean, the last thing I'm going to worry about is expense reports.
If I need to, you know, I'll just pay my Amex bill in whole one month. That's what I need to do to to keep the staff focused. Well, you don't always have that option with technicians or public sector.
You know, you have that accountability. You need to make sure that the money that's being spent is is reconciled and that it's accounted for. Because, again, you know, they don't they operate under stricter contractual and regulatory obligations.
So employees, contractors who do emergency response, again, they need to have those advances and reimbursements on time. They don't have that same luxury as a private sector organization might. And so, again, that's where where we look at, again, in private sector, we really don't say concurrence is mission critical from a disaster recovery perspective.
But for public sector clients and regulated industries, we say it's you know, it's mandatory. Even if you do the reconciliation a month down the road, you still need to make sure, you know, in an outage or service degradation of your accounting system that you can still get money in employees hands so they can complete the requirements of their job obligations.
Megan Billingsley
Fantastic. Thank you so much. I think that that really underscores why these systems are mission critical, not optional.
All right, Tim, your turn in the hot seat. I'd love to bring you in on another mission critical topic, cybersecurity. So we hear a lot about cyber attacks on utilities targeting operational technology.
But should utilities be thinking more broadly about where they're vulnerable, including their financial and administrative systems?
Tim Martino
Yeah, the short answer is yes, absolutely. So for years, utility cybersecurity was probably just entirely focused on OT or the operational technology, things that control the lights being on and the physical infrastructure. So now comes IT.
That's the business systems, HR systems, finance, ERPs, things like that. They were treated separate. But over the last 10 years, maybe longer, but that separation has really ceased to exist.
Utilities are connecting OT systems with their IT systems. This is done for performance, for monitoring, for data sharing, really connecting these systems for all those reasons. But as that that dissolvement of the connection between the two systems happens, the ability for a exposure or a data problem on one system can affect another.
So something in the ERP can downstream of negatively affect something upstream in an OT system and vice versa. So you really have to protect both of those systems with the same view and with the same priority. So that's, I think, something that still gets overlooked in all this.
And there's also the processes that are manual and paper based as we undergo digital transformation, as we bring more IT systems into the mix. That's when we're adding more points of exposure and more systems that even if they're not talking to OT systems may may contain sensitive data that you do need to make sure is protect. And that includes, you know, HR information.
So who has access to both those OT and IT systems? Does that user still need access? Is that is that a contractor?
Did their employment or contracts end six months ago? So knowing who has access to all the different systems and have an auditable trail to see who has gained access and why they need access, all that needs to be, you know, available to you with all your systems. And it really starts with the visibility of it.
Right. So knowing those systems and knowing who who has access, you know, that's where you're looking at. What are our possible exposure points?
And then once you have that, you can start looking at the data flow and, you know, the path becomes clearer on once we know what our systems are, how can we secure it?
Megan Billingsley
Yeah, that makes a lot of sense. I think it's essential to be clear where vulnerabilities may be. So, Tim, what's the next step after completing a mapping of your data and systems?
Tim Martino
Yeah, I'd like to I think of it as basically five steps that you really want to walk through. And that first I touched on was access review. And this really needs to be a real documented, scheduled process for, you know, all the different systems.
But high priority systems, you're going to want to have a biannual or quarterly access review. Who has access to what? Do they still need access?
What is the what is the role justified? Has the role ended? You need to know all these things, all these items about your users and what systems they have access to.
So this is something that you you need for different audit reports, things like SOC, ISO, different ISO audits. You'll need this report of what are our change management when it comes to user provisioning and deprovisioning. So that's step one.
Step two would be your vendor and third party security review, viewing a vendor like Concur. So it's not whether they have a great security story at the beginning, but do they maintain it and do they prove it? And it's also important.
What data are you sharing with those third party vendors? So you want to look at every third party vendor and make sure you're only sharing what you need to share in order to use that service. And third is to prioritize by risk.
OK, some systems, finance, HR, those systems are high priority systems like that, maybe managed parking or lunch orders, not so high priority. So those systems don't need the same level of scrutiny, don't need the same time, amount of time and effort put into them. Fourth is consolidate the fewer systems you have.
Obviously, it means the fewer systems you have to monitor, you have to account for. So less systems, the better. And that helps streamline the organization.
And fifth and lastly on these steps is monitoring. OK, so if you put all these processes and controls in place, you have to monitor just like the access reviews that need to happen quarterly or at least annually. You need to monitor your vendors.
You're for your audits, for your reports, you need to have a monitoring in place to make sure that you're adhering to to all the proper practices of this management. And this is what Concur does. So we provide multiple different reports around access control and we have logging reports as well.
So you can see who has access to what at any time from users that are in SAP Concur, what they have access to, as well as all the transaction logs. So any time any transaction happens, you know, Mark talked about all about the reimbursement process and approvals, all that's logged and viewed to authorized personnel within Concur to make sure, you know, everything happened the way it did and able to report on it if there is a problem or something needs to be checked.
Megan Billingsley
A very clear plan of action. Thank you for walking us through that. Now, we heard from Mark about the inefficiency and problems that come from fragmented systems.
So, Tim, what are the cybersecurity implications of fragmented systems?
Tim Martino
Yeah, I think that all comes down to visibility, right, so are really the lack of it. So you can't protect what you don't see. So if you don't know what systems you have on your network and especially when they're disconnected from each other, right, when you can't answer basic security questions like what vendors have access to our network or what systems do we have set up connecting outside our network right now?
So you have to know who all these systems are or what all these systems are and who has access to it, because that all adds up as you add additional systems. Again, that digital transformation, we're going to have new systems that are replacing those paper-based systems that come in new systems. You're going to have to manage that.
And are they disconnected? That gives another point of entry for attackers to probe, right? So ransomware.
Ransomware is a huge problem across every industry, including utilities, but they target fragmented environments. They're looking for environments with different endpoints to enter, especially when cross-system controls are not in place. So one, again, you can get into the finance, maybe you can get into a financial system and affect something in the OT system.
And vice versa. So that's where ransomware is not always looking at just stealing of data. They're also looking for operational breakdown and organizational trust.
So that's something that fragmented systems handle, or account for, but there's also third-party risk, right? So that happens in the same way. Each additional system of a third-party vendor outside means that's somebody else you have to look at.
And it's an additional surface where your data could be compromised, that could affect you. So again, having a view into that vendor, knowing their security practices, what data you're sharing with that vendor is important. So consolidating on Concur for the purposes of travel and expense or invoice doesn't eliminate all that.
So you still have other vendors, but what changes with Concur is you have a clear view on Concur's security. You have a clear view on the account management within Concur, knowing what your users have access to, what roles every user has, and what they can see, as well as all the logging that's undergone in Concur that you have visible to you.
Megan Billingsley
Got it. Concur is an opportunity to consolidate disparate systems. So Tim, what is that process like for utilities and what are the benefits?
Tim Martino
Yeah, I think consolidation looks different across every organization or every utility, but there's certain principles that hold true no matter who you are. So first, Concur operates on a minimal data principle. So we only collect what's needed to use the service, as well as what you need to flow back into your back-office systems, your ERP or financial systems.
So that's usually the opposite of fragmented systems. Fragmented systems typically work where data accumulates across these systems. Maybe nobody's asking, why do we have this data here?
Why does anybody have access to that data? Does it need to be here? So data more accumulates instead of being managed.
And second, consolidation itself may not be a security event, but it could generate a security event. And what I mean by this is, say, moving to a system like Concur, you need to provision users into Concur. What if you look at this as an opportunity, if you will, to examine the user management in your financial system, saying, let's look at everybody that has access to our financial system before we provide them access to Concur and see, do their roles still match?
Are they still with the organization? So doing these security reviews, I think, is a good way to, one, ensure you're setting up the proper security rules and permissions within Concur, but also looking internally and making sure you don't have people accessing things they shouldn't. And again, one other option or one other thing when you implement, which you have a couple options here, when you implement adding those users, provisioning those users to Concur, you can provide a full upload of your whole organization, the whole utilities, HR system.
We can take a feed of everyone. Now, you can also feed us just the users you would want to. This is really based on your option, but security-wise, looking at it from a security professional, why not go with just the minimal amount, putting in a tighter group of people that need to access Concur and then expanding as you move on?
This just helps manage in Concur, in a new external system, if you will, it helps manage your user base easier and more streamlined, if you will. So again, and when you're on the other side of Concur, that security picture changes. So you are now, you can generate reports.
You can have monthly reports or even weekly reports of how is our configuration? Who is our, how is our hierarchy set up in Concur? Who has access to what?
Who is approving for what? So we have built-in reporting that gives you an on-demand view of all those things, all those user access and logging things that you can see within Concur.
Megan Billingsley
Excellent. Thank you. What are some of the most valuable security features once Concur is in place?
Tim Martino
Yeah, well, there's a lot and I could go probably a long time on this with my role and the expertise, but I'll highlight a few that I think really are impactful to a utility. So first is that visibility. I've kind of hyped or harped on this throughout the discussion today, but it's that visibility and access control that really is part of the daily operations.
So it's not just an audit calendar event that you need to do once a year. You can have reports weekly, monthly, daily, if you wish, that finance and IT are both using about different users in Concur and what those users are available or have the ability to do, whether they're approvers, whether they can use expense, whether they can use travel. Is their role a contractor?
So that role-based security model is available to the people that manage the roles within Concur. Second, I would think, and maybe it's not as obvious, but knowing Concur's security posture, having that visibility will give probably people in the security organization maybe a little time back. All right.
Now, everybody's stretched thin, especially across security orgs, but with Concur's transparency, Concur showing and proving with its certifications and all our public available information, you may gain a little time back knowing that I'm not constantly monitoring, I'm not constantly worried about what's going on with Concur. I have all that available to me. I can see it all and I can focus on other things that I need to worry about or the organization needs to worry about.
And then I would also like to talk, we talked about the availability and Mark talked about mission critical in the public sector or regulated industries and specifically for utilities. It is maybe not mission critical, but it is important. And that's why also SAP Concur provides for availability.
So we contractually guarantee 99.7% availability for our service, which is important because utilities, they're getting the lights back on. We want to be available to you and we're doing that by providing that 99.7% availability. We also have an RPO of one hour and an RTO of 12 hours.
So those are also contractually guaranteed within our solution. So the field crews that need to be funded, we need to provide a service that is available to you. And besides just having those numbers available, Concur provides a public website that shows the availability status.
You can log in, create an account, log in, you can get notified. So you're always aware of if there's any issues affecting any of the services that utilize SAP Concur. So that transparency is really what matters.
And speaking of the transparency, Concur provides the SAP Concur Trust Center. So publicly available website for anyone to go to right now. And as long as you're a client for certain audits and reports, you can request them.
But this site is where we can contain all our audits, our certifications and our security controls. And really, what do these cover? They cover all the security features we have within SAP Concur.
This includes end-to-end encryption, single sign-on, multi-factor authentication. We have a FedRAMP environment for those organizations that demand, maybe do government work and demand a FedRAMP environment. But we also have things like role-based access controls, continuous threat monitoring, vulnerability management, those penetration tests, those other scans to make both internal and external.
So everything we have that we're doing to secure the environment and to secure your data, that's available on the Trust site. So, again, you don't have to take my word for it. The proof is out there on the Trust site with everything available that you have to you.
And, again, finally, I'll close with this, is it's not just the platform itself. So you have a dedicated team at SAP Concur. You have Mark at Genesys.
You have an account executive at Concur. You have a customer success manager at Concur. You have myself on the security side.
You will have direct access to me. So if it's a question from your CISO or compliance concern or if it's an integration issue or it's a performance issue, there's always somebody from the extended team that's going to be available to service you.
Megan Billingsley
Those are some great highlights. Thank you so much. We are going to turn to some audience questions in just a moment.
But before we do, one final question for you, Tim. How can Concur help with the documentation regulators, insurers and others want now?
Tim Martino
For the documentation, the SAP Trust site is where all that documentation lives. So going to the site and searching under the compliance section will take you to where you can filter it strictly for Concur and you can see the different audits and certifications for Concur. There's different headings.
The security part heading talks about the security of like incident management as well as the agreement section talks about like DPAs. And I'm trying to remember all the sections off the top of my head. But this is the main place for any audit report to request from SOC, PCI, DSS, ISO 27001 and others that we undergo.
Megan Billingsley
Perfect. Thank you so much. Excellent insights on transforming financial operations from a vulnerability into a strategic asset.
So with the time that we have left, I would love to shift to some questions from our audience today. Mark, it looks like this one is for you. How does Concur handle reimbursements for contractors and mutual aid personnel that utilities rely on for outage response?
Mark Block
Thank you. That's a great question. You know, one of the benefits of Concur is it does have the ability to, you don't have to be an employee of the organization.
You know, someone, if you have to engage, say, you know, three or four contractors to help, you know, during an outage, it really is a minimal amount of time for someone to go in and add those individuals to Concur if they're not already. And then by using Concur, you can facilitate and make sure that they get the same reimbursement structure and get the same funding processes. So again, you know, Concur is typically set for employees, but contractors or other contingent workers that may need to be brought on, it's very easy to get those individuals added to the platform and quickly process reimbursements in the same amount of time as a full-time employee.
Megan Billingsley
Excellent. Thank you. Tim, this next one asks if you can say more about the risks of a cybersecurity attack during an outage, what are the risks and how does Concur help address them?
Tim Martino
Yeah, and actually, I think cyberattacks happen, cyberattacks are most likely to happen, you know, during an outage because when there's pressure to restore power or respond to an event, that's when controls are going to get bypassed, our process is going to be skipped. And so this is when attackers are going to move in, right? They're going to look at the financial system.
And since processes are getting skipped, people may not question so much of why they're receiving these messages or why they need to do this approval process. And if you don't have an audible portrayal of what happens, then you're not going to be able to respond to regulators or you can't document that incident and you can't defend against any follow-up attacks. So again, Concur provides an audible trail, access transaction logins, so you know what happened at what time.
So during your event that the utility is responding to, you know, if something happened with questionable reimbursement, that information is easily maintained in Concur and viewable and reportable in Concur.
Megan Billingsley
Excellent. Thank you. One more question for you, Tim.
Is the case for modernization as strong for public utilities and co-ops as it is for large IOUs?
Tim Martino
Yeah, I think the case is actually stronger for those smaller utilities and co-ops. So the starting point is the threat actors, they don't care. Right.
If you're big, small, co-op, it doesn't matter. They look for easy entry points. So a co-op with fragmented systems is really could easily just be just as exposed as one of those large IOUs.
So the attack surface doesn't scale down because the organization is smaller. Right. It could still exist.
But the capacity to defend against those attacks usually does scale down. So large IOUs can probably afford to have those fragmented systems. Right.
They can absorb the risk. They probably have a dedicated security team and an IT staff. Maybe they have to even budget to manage that vendor sprawl.
But those smaller utilities and co-ops are usually not going to have that. So the same regulatory obligations do apply to all these utilities, regardless of the size. The audits don't shrink because you're a co-op.
The documentation burden is going to be the same. But again, at the same time, those smaller utilities and co-ops are going to have less ability to respond to these cyber attacks that could stem from these fragmented systems.
Megan Billingsley
Yeah, that makes a lot of sense. Thank you so much. That is all the time that we have for today.
I'd like to thank our speakers, Mark and Tim, for a great discussion. We appreciate you sharing your insights and expertise with us. I'd also like to thank our audience for joining us today.
We hope to see you again soon. Have a great day.
Anthony Jimenez
Thanks for listening. Thank you to our guests, Mark Block and Tim Martino. Don't forget to like, comment and subscribe to Carahcast and be sure to listen to our other discussions.
If you'd like more information on how SAP Concur can assist your organization, please visit www.carahsoft.com or email us at concur@carahsoft.com. Thanks again for listening and have a great day.