AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
46
INTERNATIONAL JOURNAL OF NETWORKS AND SECURITY (ISSN: 2693-387X)
Volume 05, Issue 01, 2025, pages 46-56
Published Date: - 24-04-2025
Doi: -
https://doi.org/10.55640/ijns-05-01-04
Enhancing Data Security in ERP-Based Human Capital
Management (HCM) Systems: A Study through Workday Security
Framework
Manoj Varma Lakhamraju
HR Technology, Charlotte, NC, USA
ABSTRACT
In today’s world, it’s really important to keep employee data safe in ERP systems. This study looks at
how to protect
data in Human Capital Management (HCM) systems, focusing on how Workday keeps information secure. The
paper explains how Workday’s security features, like customizable settings and role
-based permissions, help
protect company data. It also looks at how Workday follows international rules to make sure data stays safe. The
study talks about two main types of security policies: domain security and business process security. Domain
security decides who can see or use certain data. Business process security controls how users interact with
important tasks, like hiring and payroll. Both policies work together to keep data safe and make sure good security
practices are followed. The paper also points out the importance of setting up security controls that match the
company’s needs. It also stresses that companies need to regularly check and update their security systems to
keep data safe. The study shows that Workday’s security system does a good job of reducing risks in ERP
-based
HCM systems. But there are still challenges, like dealing with complex data, managing security, and connecting
different systems. The paper offers advice on how to handle these problems. It also says that training programs
are needed to help employees understand how to use the system properly. The paper suggests using role-based
access to improve security. Looking to the future, it recommends using AI and machine learning to spot threats
early and manage who can access sensitive data. By using these tools and improving security rules, companies can
make their ERP systems even safer. Lastly, the paper gives practical tips for organizations to improve their security
using Workday’s features
.
KEYWORDS
ERP security, Human Capital Management, Workday, data security, role-based permissions, domain security
policies, Business process security, AI in security, data privacy, ERP integration, Blockchain Security.
INTRODUCTION
Adding Human Capital Management (HCM) into Enterprise Resource Planning (ERP) systems has changed how
companies manage employee data. But this change also brings problems, especially around keeping employee
information safe and private (Bowman, 2025). As companies depend more on ERP systems, protecting employee
data from unauthorized access and other security risks is becoming even more important (Metha, 2025). Workday,
a well-known company that offers cloud-based HCM solutions, has created a strong security system to help with
these issues (Yerra, 2023). This system includes features like custom security settings, role-based permissions, and
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
47
following global security rules to protect company data (Workday, n.d.). It’s important to understand how
Workday’s security system works to help companies protect their data.
In this paper, we look at the parts of Workday’s sec
urity system and how they help protect employee data in ERP
systems. We examine how Workday allows security settings to be changed, how role-based permissions work, and
how it follows rules like ISO 27001 and ISO 27018 (Psicosmart, 2024). By looking at these features, we aim to show
how Workday’s security system helps keep data safe and how it can help improve data security in ERP
-based HCM
systems. This paper also talks about the need to set up security systems that match the way a company is organized
and the importance of keeping the system checked to make sure data stays safe (Reco, 2024). We also suggest best
practices for companies to use when setting up or improving their ERP security systems, using Workday’s methods
as examples.
Table 1 below shows common problems that ERP data faces and explains how Workday can solve these problems
with good solutions.
Table 1: ERP Data Security Challenges and Workday Solutions
ERP Data Security
Challenges
Description
Workday Solutions
References
Unauthorized Data
Access
Sensitive employee and
financial data can be
accessed without
permission if there aren’t
proper controls.
Workday uses security rules based
on roles to control who can access
data, depending on what their job
is. It gives detailed access based
on the company’s needs.
Workday
(n.d.), Surety
Systems
(2023)
Compliance with
Data Protection
Regulations
Companies must follow
laws like GDPR and ISO
standards to avoid fines.
Workday follows global security
rules like ISO 27001 and ISO
27018 to make sure security
follows worldwide data protection
rules.
Psicosmart
(2024); Macha
(2023)
Data Integrity and
Accuracy Risks
Incorrect data entry or
changes can mess up ERP
records.
Workday has rules to make sure
only authorized people can start,
approve, or change important
business tasks, which helps avoid
errors.
Bowman
(2025)
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
48
Data Breaches and
Cybersecurity
Threats
ERP systems are often
targeted by hackers,
which can cause financial
and reputation damage.
Workday uses encryption, secure
connections, and regular security
updates to keep data safe from
breaches and unauthorized access.
Workday
(2016)
Segregation of
Duties Conflicts
Having unclear roles can
lead to fraud or legal
problems.
Workday’s rules allow
organizations to clearly define
roles and responsibilities at each
step of a process to prevent fraud.
Reco (2024)
Complexity of
Security
Management
Organizations struggle to
manage security as
business needs and roles
change.
Workday’s flexible security
system makes it easier to manage
who can access what, even when
roles change or need to be
updated.
Surety
Systems
(2023)
Integration Security
Risks
Integrating with third-
party systems can expose
data to leaks or
unauthorized access.
Workday uses special security
groups to control access to
integration tasks and protect data
when systems communicate with
each other.
Vorecol (2024)
Human Error and
Insider Threats
Employees might
accidentally share
sensitive information or
break security rules.
Ongoing training and secure
access rules help companies create
a culture of security and reduce
human mistakes.
Top10ERP
(2024)
Scalability and
Flexibility for
Dynamic Business
Environments
Fixed security rules can’t
keep up with changes in
the business or
workforce.
Workday automatically adjusts
security settings based on changes
in the company or employee roles,
so it stays up to date.
Schwarz
(2024); Macha
(2025)
This analysis shows how important it is to have strong security in ERP-based HCM systems and gives
helpful advice for companies that want
to improve their data security. As technology changes, it’s crucial
for organizations to keep up with new security methods and best practices to protect their employee data.
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
49
Implementation of ERP Security Framework and Security Groups in Workday
Workday’s
security system is designed to be flexible, so companies can adjust security settings based on
what they need. One important part of this system is the use of security groups. These groups are made
up of users who are given specific permissions in the system. Security groups help control who can access
things like tasks, reports, pages, and integrations (Surety Systems, 2023). By using security groups,
companies can make sure that users only have access to the things that are needed for their job.
Figure 1 below shows the rate of security risk before and after the implementation of Workday ERP
security:
Figure 1: Impact of Workday ERP Security Features on Risk Reduction (Workday, (n.d.); Workday,
2016)
There are several types of security groups in Workday, each serving a distinct purpose and below are the commonly
used security groups:
Aggregation Security Group:
An aggregation security group is a special type of security group that combines several
groups into one. It helps make security management easier by allowing companies to control who can access what
based on certain rules. Users in groups that are part of the inclusion rule get access, while users in the exclusion
rule don’t. If someone is in both groups, they don’t get access. This helps keep thin
gs simple and ensures that
everyone only has access to what they need.
Use Case:
A company might create a security group for HR Partners. This group combines permissions from different
HR groups, allowing HR Partners to access needed data across different parts of the organization.
Conditional Role-Based Security Group:
A conditional role-based security group gives access to people based on
their roles and certain conditions set by the company. These conditions might depend on where the person works,
what job they do, or legal rules. It helps limit access to sensitive data, ensuring that only qualified people can see it.
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
50
Use Case:
In Germany, companies must follow rules to protect employees' rights. A security group can be set up to
make sure only authorized HR staff can access data for workers in Germany, following the law.
Integration System Security Group:
An integration system security group is used to control access for system users
who need to connect Workday to other systems. This helps make sure only the right users can send or receive data
between Workday and other systems like payroll or benefits.
Use Case:
A credit card company that integrates with Workday might need an integration system security group to
ensure secure data transmission. This security group makes sure that the system user is granted permission to
access only the necessary web service tasks, safeguarding other confidential data from exposure.
Intersection Security Group:
An intersection security group includes only people who are part of all the security
groups listed. If someone is in just one or none of the groups, they don’t get access. This helps make sure people
have the right combination of access for specific tasks.
Use Case:
A company might create an intersection security group for employees based in the U.S. who are also part
of the Employee as Self security group. This ensures that only those employees who satisfy both conditions can
submit expense reports, thereby preventing unauthorized submissions from non-U.S. employees or contractors.
Job-Based Security Group:
A job-
based security group gives access based on the employee’s job, not their location
or role. This means employees get access to what they need automatically based on their job title, making it easier
to manage security.
Use Case:
If a company wants to guarantee that the Chief Human Resources Officer (CHRO) consistently has access
to certain HR reports and confidential information, they can establish a job-based security group. Once an employee
takes on the CHRO position, they are automatically provided with the required access.
Level-Based Security Group:
A level-
based security group organizes users by their position in the company’s
hierarchy. This helps control who can see information depending on their management level in the company.
Use Case:
A company might establish a level-based security group that enables managers to access performance
and talent data for their direct reports. This ensures that managers have the essential information needed to assess
their teams without accessing data that exceeds their hierarchical level.
Location Membership Security Group:
A location membership security group gives access based on where the
employee works. This is helpful for limiting access to data that is only relevant to certain regions or countries.
Use Case:
If a company aims to provide access to location-specific data for all employees in Tokyo, they can establish
a location membership security group. Workers based in Tokyo would automatically be included and given the
necessary permissions.
Organization Membership Security Group:
An organization membership security group gives access based on the
employee's affiliation with a specific organization within the company, like cost centers or departments. This helps
keep data secure by limiting access to people within the same organization.
Use Case:
A company could set up a security group that allows employees within a legal supervisory organization
to access all worker data within their tenant, while blocking access for users outside of that legal framework.
Prism Access Security Group:
A Prism Access Security Group controls who can access data for Workday Prism
Analytics, a tool used for data analysis. This security group ensures only the right people can view and work with
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
51
sensitive data for reporting and decision-making. It guarantees that users can access essential datasets while
upholding data privacy and security. Organizations can impose restrictions aligned with their business needs,
ensuring that only authorized individuals can handle and analyse data within Workday Prism.
Use Case:
An organization might grant permissions to the Prism Data Administrator security group through a Prism
Data Admin - PASG Prism Access Security Group. This arrangement ensures that users responsible for managing
Prism-related domain security policies have the required access while safeguarding against unauthorized
modifications to sensitive data. By utilizing a Prism Access Security Group, companies can effectively oversee their
data governance policies while enabling secure data analysis (Mittal, 2025).
Role-Based Security Group:
A role-
based security group gives access based on an employee’s role within the
company. This allows organizations to set up permissions that automatically match employees with their job duties.
Organizations implement Role-Based Security Groups to automatically assign permissions as users take on new
roles. When an employee is assigned a specific role within Workday, they automatically receive the security
permissions associated with that role. This approach minimizes the need for manual security management and
promotes efficient access control.
Use Case:
A company might utilize a Role-Based Security Group to provide support and leadership staff with access
to particular data and tools. For instance, HR managers may need to view employee performance reviews, while
finance officers might require access to payroll information. By using role-based security, organizations can
effectively enforce security measures while ensuring that employees have the necessary resources to carry out their
responsibilities.
Rule-Based Security Group:
A rule-based security group adds extra conditions to the security rules, allowing
companies to control who can access certain data based on additional factors, like job attributes or employment
status. This type of security group is particularly useful when access needs to depend on job attributes, employment
status, or other organizational factors. Organizations can utilize rule-based security to adhere to regulatory
requirements, protect data, and streamline internal processes.
Use Case:
A company might establish a Rule-Based Security Group to permit only part-time employees to track their
work hours using Workday’s time
-tracking features. This can be accomplished by creating a security rule that filters
users based on the ‘Time Type’ security field. By implementing this, the organization ensures that only those
classified as part-time can access the time-tracking functionality, preventing full-time employees from making
unnecessary adjustments.
Segment-Based Security Group:
A segment-based security group allows companies to control access to specific
parts of data, rather than giving access to all of it. This helps prevent unauthorized users from seeing parts of data
that they don’t need. This type of security group is particularly
useful for organizations that need to offer targeted
access to certain types of data while preventing unauthorized users from accessing restricted segments. It assists
businesses in maintaining compliance with data security policies by minimizing exposure to sensitive information.
Use Case:
A company might create a Segment-Based Security Group for Benefits Administrators, ensuring they can
access only benefits-related documents while blocking access to payroll data. This allows administrators to perform
their responsibilities effectively without compromising confidential payroll records. Organizations can leverage
segment-based security to safeguard sensitive information while permitting employees to access only the data
pertinent to their roles.
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
52
Service Centre Security Group:
A service center security group is used to give external users, like contractors or
temporary workers, access to certain Workday features. This keeps them from seeing or changing sensitive
company data while allowing them to perform their specific tasks.
Use Case:
A company might give temporary workers access only to benefits information during busy hiring periods,
making sure they can't see anything else.
User-Based Security Group:
A user-based security group is set up for specific users who need access to certain data,
no matter what job they do. This is useful for employees who need ongoing access to certain information, even if
they change roles.
Use Case:
A bank might create a security group for bank administrators who always need access to certain systems,
even if their roles change within the company.
Domain and Business Process Security Policies
In addition to the above security group information, Workday employs domain security policies and business
process security policies to further refine access control:
Domain Security Policies:
Domain Security Policies in Workday help decide who can see or use different types of
information, like employee data, financial records, payroll, or performance reviews. A domain is a collection of
related data, tasks, or reports. These policies are made to protect sensitive information by only allowing authorized
users to access it.
For example, an HR worker might be able to see and change employee pay details, while a finance manager might
be allowed to see budget and expense reports. Workday lets companies set up these policies to match their needs,
such as what data needs to be protected and who can access it.
Workday administrators (people who manage the system) create and assign these policies by deciding which groups
of users get to see or do certain things. It's important to review and update these policies regularly to keep the
system secure, especially if employees change roles or if the organization’s structure changes. By using domain
security policies, Workday helps keep data safe, follows the rules, and ensures that only the right people have access
to important information.
Business Process Security Policies:
Business Process Security Policies in Workday manage how users work with
different processes in a company, like hiring a new employee, paying workers, or approving time off. A business
process is a set of steps to complete a task. These policies define which users or groups can start, approve, or change
tasks within a process. changes.
For example, an HR manager might be able to start and approve new hires, while a regular worker might only be
able to ask for time off. Supervisors might be allowed to approve timesheets or performance reviews for their team
members.
Workday administrators set these policies to match different roles in the company. This ensures that tasks are done
by the right people at the right time. These policies also make sure that important tasks are handled by different
people to avoid mistakes or conflicts. By managing business process security policies well, companies can make sure
tasks are done correctly and safely. It also helps keep track of who did what, which is important for accountability.
Regular reviews of these policies ensure that everything stays up to date as the company changes or grows. In both
cases, setting up these security policies properly helps protect important company data and ensures the right
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
53
people have the right access. Regular updates are key to keeping things secure and running smoothly as the
company changes (Vorecol, 2024).
Key Takeaways
This study shows how important it is to have strong security for ERP-based Human Capital Management (HCM)
systems, especially when using Workday. A key point is the need for security settings that can be adjusted to fit a
company’s specific needs. Workday uses different types of security groups, like role
-based, job-based, and
organization-based groups, to make sure that only the right people have access to certain data and tasks. This helps
prevent unauthorized access and makes work more efficient (Surety Systems, 2023).
Additionally, Domain Security Policies and Business Process Security Policies further improve Workday’s security
measures. Domain Security Policies control who can access certain data, like employee records or financial reports.
On the other hand, Business Process Security Policies control how users interact with company processes, like hiring
new employees or approving payroll, making sure only the right people can start or approve these tasks (Workday,
n.d.).
Another important point is Workday's compliance with international security standards such as Another important
point is that Workday follows global security standards like ISO 27001 and ISO 27018, which shows the company’s
strong commitment to protecting data and following the rules (Psicosmart, 2024). Companies should regularly
review and check their security settings to ensure everything is secure and up to date with changing rules and needs
(Reco, 2024).
In summary, it’s
crucial to have a flexible, secure, and compliant security framework to protect sensitive employee
data in today’s fast
-changing digital world.
Future Directions
Looking ahead, there are several promising directions for improving the security of ERP-based HCM systems. One
key area is the integration of artificial intelligence (AI) and machine learning (ML) technologies. These tools can help
detect threats in real-time by analysing user behaviour patterns and identifying system anomalies, offering
proactive security solutions (Bowman, 2025). By incorporating AI-driven analytics, Workday can enhance its security
measures and respond more effectively to emerging threats (Mittal, 2024). Another important trend is the
implementation of dynamic and behavioural access control measures. With more people working remotely or in
hybrid work environments, identity-based access strategies that adjust permissions based on user behaviour and
other contextual factors will be critical. Additionally, using advanced authentication methods like biometric
verification and multi-factor authentication can further protect access to systems (Vorecol, 2024). As global data
protection laws become stricter, ERP providers like Workday need to proactively implement new compliance
strategies while ensuring their systems remain user-friendly (Surety Systems, 2023). Furthermore, improving
employee training and awareness is essential. Even with robust security protocols, human errors can still pose
significant risks. Organizations should prioritize ongoing training programs to create a workforce that is aware of
security challenges (Top10ERP, 2024). Lastly, encouraging collaboration among ERP providers, cybersecurity
professionals, and regulatory bodies can help establish industry-wide security standards and best practices,
benefiting everyone involved in ERP-based HCM systems (Schwarz, 2024).
CONCLUSION
ERP-based Human Capital Management (HCM) systems are important for organizations to manage their workforce.
However, they come with security challenges that need strong and flexible security systems. This study shows how
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
54
Workday’s security features help address these challenges. Workday has customizable security settings and role
-
based access controls to ensure that only the right people have access to the right data. It uses different security
groups, like role-based, job-based, and organization-based, to match access with user responsibilities, which
reduces the risk of unauthorized access (Surety Systems, 2023).
Workday also uses Domain Security Policies and Business Process Security Policies to add more control. Domain
Security Policies control access to specific data, like employee records and financial details, while Business Process
Security Policies manage how users interact with important processes, like hiring and payroll. These layered controls
help keep data safe, reduce errors, and make sure best practices are followed (Bowman, 2025).
Workday follows international security standards, like ISO 27001 and ISO 27018, which shows its commitment to
protecting customer data. Organizations using similar systems can better handle regulatory challenges and build
trust (Psicosmart, 2024). Regular monitoring and security audits are also recommended to keep systems secure as
organizations change and new security threats appear (Reco, 2024).
But technology alone isn’t enough; human factors matter too. Organizations should focus on training their
employees and raising awareness about security. Regular training helps reduce the risk of human errors and
protects data (Top10ERP, 2024). Looking ahead, using AI and machine learning in security systems could help detect
threats and create flexible security solutions (Metha, 2025). As remote work grows, using identity-based and
context-driven access controls will become more important. Collaborating with cybersecurity experts and
regulators to set security standards will improve ERP-based HCM systems (Vorecol, 2024).
In conclusion, it’s important to have a flexible, strong, and compliance
-focused security system to protect sensitive
employee data. Workday’s security framework is a good example of how ERP systems can balance security and
efficiency. By using smart security strategies and promoting security awareness, organizations can protect
themselves against new threats and keep their systems safe.
REFERENCES
1.
Psicosmart. (2024). The Role of ERP Software in Enhancing HR Data Security: Best Practices and Innovations.
Psicosmart.
https://psicosmart.net/blogs/blog-the-role-of-erp-software-in-enhancing-hr-data-security-best-
practices-and-innovations-224909
2.
Metha, Shubham. 2025. “AI
-
Driven Fraud Detection: A Risk Scoring Model for Enhanced Security in Banking”.
Journal of Engineering Research and Reports 27 (3):23-34. 10.9734/jerr/2025/v27i31415
3.
Mittal, Prakhar; AI-Powered Product Analytics in Med Tech Product Development -From Raw Data to Actionable
Insights
https://africanjournalofbiomedicalresearch.com/index.php/AJBR/article/view/6577/5270
2024.
https://doi.org/10.4314/ajbr.v27i1.7
4.
Workday.
(n.d.).
Security
and
Privacy:
Trusting
Workday
with
Your
Data.
Workday.
https://www.workday.com/en-us/why-workday/trust/security.html
5.
Mittal, Prakhar; Digital Transformation in Project Management Revolutionizing Practices for Modern Execution.
Project Management Information Systems: Empowering Decision Making and Execution1205-2322025. IGI
Global, 10.4018/979-8-3373-0700-8.ch006
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
55
6.
Yerra, S. (2025). The role of Azure Data Lake in scalable and high-performance supply chain analytics.
International Journal of Scientific Research in Computer Science, Engineering and Information Technology,
11(1), 3668
–
3673. https://doi.org/10.32628/cseit25112483
7.
Bowman, K. (2025). What is ERP Data Security. Pathlock. https://pathlock.com/learn/what-is-erp-data-
security/.
8.
Surety Systems. (2025). Workday Security Guide: How to Make the Most of It. Surety Systems.
https://www.suretysystems.com/insights/workday-security-guide/
9.
Yerra, S. (2023). Leveraging python and machine learning for anomaly detection in order Tracking Systems.
International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 9(4),
500
–
506. https://doi.org/10.32628/cseit2311354
10.
Mittal, P. (2024). Applying pumpkin lifecycle management as an analogy for product lifecycle management.
International
Journal
of
Science
and
Research
(IJSR),
13(11),
1568
–
1569.
https://doi.org/10.21275/sr241126004543
11.
Vorecol. (2024). Strategies for Ensuring Data Security in HR ERP Implementation. Vorecol.
https://vorecol.com/blogs/blog-strategies-for-ensuring-data-security-in-hr-erp-implementation-8412.
12.
Workday. (n.d.). Compliance and Third-Party Assessments. Workday. https://www.workday.com/en-us/why-
workday/trust/compliance.html.
13.
Top10ERP.
(2024).
ERP
Security
Best
Practices
for
Sensitive
Data.
Top10ERP.
https://www.top10erp.org/blog/erp-security.
14.
Reco.
(2024).
Configuring
Workday
Security
and
Role-Based
Permissions.
Reco.
https://www.reco.ai/hub/configuring-workday-security-role-based-permissions
15.
Macha, Kiran Babu. (2023). ADVANCING CLOUD-BASED AUTOMATION: THE INTEGRATION OF PRIVACY-
PRESERVING AI AND COGNITIVE RPA FOR SECURE, SCALABLE BUSINESS PROCESSES. 13. 14-43.
16.
Schwarz,
L.
(2024).
HCM
&
ERP:
Differences
&
Benefits
of
Integration.
NetSuite.
https://www.netsuite.com/portal/resource/articles/erp/hcm-erp.shtml.
17.
Workday. (2016). Workday Security. Workday. https://dev.mktg.workday.com/content/dam/web/en-
us/documents/datasheets/datasheet-workday-security.pdf.
18.
Shubham Metha. AI-Driven Promotion Platforms: Increasing Customer Engagement in Banking. Journal of
Artificial
Intelligence
Research
&
Advances.
2025;
12(01):87-92.
https://journals.stmjournals.com/joaira/article=2025/view=193238/.
19.
Yerra, S. (2025). The role of Azure Data Lake in scalable and high-performance supply chain analytics.
International Journal of Scientific Research in Computer Science, Engineering and Information Technology,
11(1), 3668
–
3673. https://doi.org/10.32628/cseit25112483
AMERICAN ACADEMIC PUBLISHER
https://www.academicpublishers.org/journals/index.php/ijns
56
20.
Macha, Kiran Babu. (2025). Integrating AI, ML, and RPA for end-to-end digital transformation in healthcare.
World Journal of Advanced Research and Reviews. 25. 2116-2129. 10.30574/wjarr.2025.25.1.0264
