orkungedik/SAP-basis-dataset huggingface dataset:
## 13.2.4.1.4  Data Storage Security
Master and transaction data of SAP Bank Communication Management is saved in the database of the SAP system in which SAP Bank Communication Management is installed.
Access to this data is restricted through the authorizations for authorization object F\_STAT\_MON . Y ou can add this authorization object to the role or user that is used by you for payment medium creation.
Payment order related transaction data is distributed to connected systems using XI, especially if the optional Integration Package for SWIFT is used.
Access to data on natural persons in particular is subject to data protection requirements and must be restricted by assigning authorizations.
## Using Logical Path and Filenames to Protect Access to the File System
SAP Bank Communication Management saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The following lists show the logical file names and paths used by SAP Bank Communication Management and for which programs these file names and paths apply:
## Logical File Names Used in SAP Bank Communication Management
The following logical file names have been created in order to enable the validation of physical file names:
- FI\_RFEBKAT0\_FILE
- Program using this logical file name and parameters used in this context:
- RFEBKAT0
- FI\_RFEBKATX\_FILE
- Program using this logical file name and parameters used in this context:
- RFEBKATX
- FI\_RFEBKAT1\_FILE
- Program using this logical file name and parameters used in this context:
- RFEBKAT1
- FI\_RFEBEST0\_FILE
- Program using this logical file name and parameters used in this context:
- RFEBEST0
- FI\_RFEBLBT1\_FILE
- Program using this logical file name and parameters used in this context:
- RFEBLBT1
- FI\_RFEBLBT2\_FILE
- Program using this logical file name and parameters used in this context:
- RFEBLBT2
Parameters used in this context: &lt;PARAM\_1&gt; Program name
Logical Path Name Used in SAP Bank Communication Management
The logical file names listed above all use the logical file path FI\_FTE\_TEST\_FILES .
## 13.2.4.2  SAP In-House Cash (FIN-FSCM-IHC)
In the following sections you can find information about the specific security functions for the SAP In-House Cash (FIN-FSCM-IHC) component.
In addition, you can access further information at the following places:
For information about the specific security functions for the component Bank Customer Accounts (IS-B -BCA), see Bank Customer Accounts (BCA) [page 826] in the Banking section.
Reason: SAP In-House Cash (FIN-FSCM-IHC) uses Bank Customer Accounts as the basis for various functions.
For information about the specific security functions for the component Bank Accounting (FI-BL), see the under Bank Accounting (FI-BL) [page 69] in the Banking section.
Reason: SAP In-House Cash (FIN-FSCM-IHC) uses various functions of Bank Accounting , such as the creation of data media for central payments.
## 13.2.4.2.1  Security Aspects of Data, Data Flow and Processes
The following sections show an overview of the data flow in the processes of SAPIn-House Cash .
##  Note
The appropriate Security Guides apply for all of the external systems that you require when using the SAP In-House Cash component. Include these Security Guides in your cross-application security concept.
## 13.2.4.2.1.1  Internal Payments
The figure below shows an overview of internal payments between two subsidiary companies and the transfer of the balances to the general ledger.
<!-- image -->
The table below shows the security aspect to be considered for the process step and what mechanism applies.
| Step   | Description               | Security Measure                         |
|--------|---------------------------|------------------------------------------|
| 1      | Payment order (IDoc/ALE)  | User type: dialog user or technical user |
| 2a     | Bank statement (IDoc/ALE) | User type: dialog user or technical user |
| Step   | Description                                                                                                                     | Security Measure                         |
|--------|---------------------------------------------------------------------------------------------------------------------------------|------------------------------------------|
| 2b     | Bank statement (IDoc/ALE)                                                                                                       | User type: dialog user or technical user |
| 3      | General ledger transfer; only relevant if SAP In-House Cash and the head office are running in two different systems (IDoc/ALE) | User type: dialog user or technical user |
## 13.2.4.2.1.2  Head Office Payments
The following figure shows an overview of the data flow if the head office takes over the payments for the payables of a single subsidiary company.
<!-- image -->
<!-- image -->
The table below shows the security aspect to be considered for the process step and what mechanism applies.
|   Step | Description                      | Security Measure                         |
|--------|----------------------------------|------------------------------------------|
|      1 | Payment order (IDoc/ ALE )       | User type: dialog user or technical user |
|      2 | Payment order (IDoc/ ALE or RFC) | User type: dialog user or technical user |
|   Step | Description                                                                                                                       | Security Measure                         |
|--------|-----------------------------------------------------------------------------------------------------------------------------------|------------------------------------------|
|      3 | Bank statement (IDoc/ ALE )                                                                                                       | User type: dialog user or technical user |
|      4 | General ledger transfer; only relevant if SAP In-House Cash and the head office are running in two different systems (IDoc/ ALE ) | User type: dialog user or technical user |
##  Note
The type of communication for the second step depends on your settings. If you have activated the In-House Cash (Enterprise) (IHC\_EP) application, then communication is by RFC. Otherwise it is by IDoc/ ALE . You can find these settings in Customizing of SAP In-House Cash under Basic Settings → Business Transaction Events/Event Control → Activate SAP Components .
## 13.2.4.2.1.3  Central Incoming Payments
The figure below shows an overview of an incoming payment that is intended for a subsidiary company of the head office.
<!-- image -->
The table below shows the security aspect to be considered for the process step and what mechanism applies.
|   Step | Description                               | Security Measure                         |
|--------|-------------------------------------------|------------------------------------------|
|      1 | Incoming payment via bank statement (RFC) | Access authorization via RFC user        |
|      2 | Bank statement (IDoc/ALE)                 | User type: dialog user or technical user |
|   Step | Description                                                                                                                     | Security Measure                         |
|--------|---------------------------------------------------------------------------------------------------------------------------------|------------------------------------------|
|      3 | General ledger transfer; only relevant if SAP In-House Cash and the head office are running in two different systems (IDoc/ALE) | User type: dialog user or technical user |
## 13.2.4.2.1.4  Local Payments
The figure below shows an overview of the data flow if a subsidiary company uses the house bank of a different subsidiary company for its payment that is located in the country of the payment recipient. This avoids having to make a foreign payment. The process flow is similar to Head Office Payments [page 98] .
<!-- image -->
The table below shows the security aspect to be considered for the process step and what mechanism applies.
|   Step | Description              | Security Measure                         |
|--------|--------------------------|------------------------------------------|
|      1 | Payment order(IDoc/ALE)  | User type: dialog user or technical user |
|      2 | Payment order(IDoc/ALE)  | User type: dialog user or technical user |
|      3 | Bank statement(IDoc/ALE) | User type: dialog user or technical user |
|   Step | Description                                                                                                                         | Security Measure                         |
|--------|-------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------|
|      4 | General ledger transfer; only relevant if SAPIn - House Cash and the head of- fice are running in two different sys- tems(IDoc/ALE) | User type: dialog user or technical user |
## 13.2.4.3  Cash and Liquidity Management
## Network and Communication Security
Communication with external systems is possible using standard interfaces via BAPI, IDoc, and XI.
## Communication Destinations
In certain cases, a technical user may be required for the use of BAPIs.
## Internet Communication Framework Security (ICF)
You should only activate those services that are needed for the applications running in your system. For more information, see Internet Communication Framework Security (ICF) [page 104].
## Data Storage Security
You can use logical path and file names to protect access to the file system. For more information, see Data Storage Security [page 106].
## 13.2.4.3.1  Internet Communication Framework Security (ICF)
You should only activate those services that are needed for the applications running in your system. For Cash and Liquidity Management, the following services are needed:
- Web Dynpro services
- WDA\_FCLM\_BAM\_ACC\_MASTER
- WDA\_FCLM\_BAM\_ACC\_REVIEW
- WDA\_FCLM\_BAM\_ADAPT\_SIGN
- WDA\_FCLM\_BAM\_BANK\_DATA
- WDA\_FCLM\_BAM\_CHGREQ
- WDA\_FCLM\_BAM\_HIERARCHY
- WDA\_FCLM\_BAM\_HIER\_BP
- WDA\_FCLM\_BAM\_HIER\_MAINTAIN
- WDA\_FCLM\_BAM\_MASS\_CHANGE
- WDA\_FCLM\_BAM\_REVIEW\_REPORT
- WDA\_FCLM\_BAM\_REQOVERVIEW
- WDA\_FCLM\_REPORT
- WDA\_FCLM\_UPLOAD\_DOWNLOAD
- WDA\_FCLM\_BAM\_SENTITEMS
- WD\_FCLM\_FPM\_OVP\_CFA
- WD\_FCLM\_FPM\_OVP\_FD
- WD\_FCLM\_FPM\_OVP\_FO
- Workflow services
- ibo\_wda\_inbox
- swf\_formabsenc
- swf\_workplace
- UCT\_DISPLAY\_DOCUMENT
- UCT\_DISPLAY\_INBOX
- UCT\_DISPLAY\_SIGNOFF
- UCT\_DISPLAY\_CHANGE
- USMD\_CREQUEST\_PROTOCOL2
- USMD\_SSW\_RULE
- USMD\_WF\_NAVIGATION
- POWL services
- POWL
- POWL\_COLLECTOR
- powl\_composite
- POWL\_EASY
- POWL\_ERRORPAGE
- POWL\_MASTER\_QUERY
- POWL\_PERS\_COMP
Use the transaction SICF to activate these services. If your firewalls use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly. For more information about ICF security, see the respective chapter in the ABAP Platform Security Guide.
## 13.2.4.3.2  Data Storage Security
## Using Logical Paths and File Names to Protect Access to the File System
Cash and Liquidity Management saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The following list shows the logical paths and file names that are used in Cash and Liquidity Management and the programs for which these file names and paths apply. The logical paths and file names have been created to activate the validation of physical file names:
Logical file names used in Cash and Liquidity Management:
- FCLM\_CM\_MEMO\_RECORD\_EXPORT
- Name of the program that uses this logical file name: RFTS6510\_CREATE\_STRUCTURE (transaction RFTS6510CS)
- Parameters used in this context: No parameters
- Logical path name: FCLM\_CM\_MEMO\_RECORD\_EXPORT
- FCLM\_CM\_MEMO\_RECORD\_IMPORT
- Name of the program that uses this logical file name: RFTS6510 (transaction RFTS6510)
- Parameters used in this context: No parameters
- Logical path name: FCLM\_CM\_MEMO\_RECORD\_IMPORT
## Activating the Validation of Logical Paths and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-dependent). To determine which paths are used by your system, you can activate the appropriate settings in the Security Audit Log.
## 13.2.4.3.3  Data Protection
## 13.2.4.4  Treasury and Risk Management
## 13.2.4.4.2  Data Protection
## 13.2.5  Financial Operations
## 13.2.5.1  Contract Accounting
## 13.2.5.2  Settlement Management
## 13.2.5.2.2  Certificate-Based Authentication with SAP Commissions
In the SAP S/4HANA Personnel Settlement integration with SAP Commissions, communication is triggered based on an OData call over http, based on an RFC connection of type G . Basic authentication is used. The
communication channel between SAP S/4HANA Utilities and SAP Commissions is secured by HTTPS SSL encryption.
To establish secure communication, you must obtain the server certificate from the SAP Commissions server instance and then use the Trust Manager (transaction STRUST) to import it into the SAP S/4HANA system.
## 13.2.6  Billing and Revenue Innovation Management
## 13.2.6.1  Convergent Invoicing, Receivables Mngmt and Payment Handling
The following section provides an overview of the security-relevant information that applies to Convergent Invoicing and Receivable Management and Payment Handling as part of Contract Accounts Receivable and Payable (FI-CA).
## 13.2.7  Real Estate Management
## 13.2.7.1  Real Estate Management
## Authorizations
## Standard Roles of Real Estate Management
| Role              | Description                                                         |
|-------------------|---------------------------------------------------------------------|
| SAP_RE_APPL       | Real Estate Management (including administration and Cus- tomizing) |
| SAP_EP_RW_REFX_I  | AC - Flexible Real Estate Management                                |
| SAP_EP_RW_REFX_II | AC - Flexible Real Estate Management - support processes            |
## Network and Communication Security
External heating expenses settlement is available In Real Estate Management. To make this settlement possible, the necessary files must be generated in the SAP system in an internal SAP format. You then need to send the data medium to the settlement company.
## Trace and Log Files
The change documents provide information on changes to the authorization group and to the person responsible for the object.
## Data Storage Security
## Using Logical Paths and File Names to Protect Access to the File System
Flexible Real Estate Management (RE-FX) saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The following lists show the logical file names an paths that are used by Flexible Real Estate Management (RE-FX), and for which programs these file names and paths apply:
## Logical File Names Used in Flexible Real Estate Management (RE-FX)
The logical file name REFX\_CREATE\_TAPE makes it possible to validate physical file names in Flexible Real Estate Management (RE-FX). The following programs use this logical file name:
- RFRESCMLTAPE
- RFRESCMLTAPECO
- RFRESCSETTLE
- RFRESCSETTLESC
- RFRESCCONTINUE
- RFRESCBOOKING
- RFRESCSETTLCO
- RFRESCCONTINUECO
- RFRESCPOSTCO
## Logical Path Names Used in Flexible Real Estate Management (RE-FX)
The logical file names of Flexible Real Estate Management (RE-FX) listed above all use the logical file path REFX\_ROOT .
## Activating the Validation of Logical Path and File Names
The logical paths and file names are entered in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). To find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log.
## 13.2.7.2  Deletion of Personal Data in RE-FX
## Use
The Flexible Real Estate Management (RE-FX) component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021
Product Assistance Cross Components Data Protection .
## Relevant Archiving Objects
| Archiving Object                               | Technical Name   |
|------------------------------------------------|------------------|
| Architectural Object                           | REFX_AO          |
| Adjustment Measure                             | REFX_AT          |
| Business Entity                                | REFX_BE          |
| Buildings                                      | REFX_BU          |
| Comparative Group of Apartments                | REFX_CG          |
| Real Estate Contract                           | REFX_CN          |
| Cash Flow of Contracts                         | REFX_CNCF        |
| Joint Liability                                | REFX_JL          |
| Land Register                                  | REFX_LR          |
| RE: Move Planning                              | REFX_MP          |
| Notice of Assessment                           | REFX_NA          |
| Contract Offer                                 | REFX_OF          |
| Offered Object                                 | REFX_OO          |
| Option Rate Determination per Object/Subobject | REFX_OR          |
| Other Public Register                          | REFX_PE          |
| Participation Group                            | REFX_PG          |
| Parcel of Land                                 | REFX_PL          |
| Property                                       | REFX_PR          |
| RE Document                                    | REFX_RADOC       |
| Parcel Update                                  | REFX_RC          |
| Rental Object                                  | REFX_RO          |
| Cash Flow of Rental Objects                    | REFX_ROCF        |
| RE Search Request                              | REFX_RR          |
| Reservation                                    | REFX_RS          |
| Archiving Object          | Technical Name   |
|---------------------------|------------------|
| Recurring Reservation     | REFX_RSREC       |
| Service Charge Settlement | REFX_SCSE        |
| Settlement Unit           | REFX_SU          |
| Correction Object         | REFX_TC          |
## Available Check
Implemented Solution: End of Purpose (EoP) check
For more information, see SAP Note 2134204 .
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
## 13.2.8  Receivables Management
## 13.2.8.1  SAP Credit Management
## 13.2.8.1.1  Technical System Landscape
## Use
This figure shows an overview of the technical system landscape for SAP Credit Management .
<!-- image -->
To exchange messages with external information providers, you have to use the Integration Server. For accounting systems as well as Sales and Distribution (SD) systems, you can configure the communication either via the Integration Server or via a point to point connection using Web Services Reliable Messaging (WSRM). The SAP Business Information Warehouse is connected via Remote Function Call (RFC).
For more information about recommended security zone settings, see ABAP Platform Security Guide .
For SAP Credit Management the business package for the Credit Manager provides you with portal content so that you can use the functions from SAP Credit Management in the portal. Security-relevant information about the use of the portal content is available in the ABAP Platform Security Guide for the usage types Enterprise Portal Core (EPC) and SAP Enterprise Portal (EP) in the portal security guide.
## 13.2.8.1.2  Security Aspects of Data, Data Flow, and Processes
<!-- image -->
This table shows the security aspect to be considered for the process step and what mechanism applies.
|   Step | Description                   | Security Measure                     |
|--------|-------------------------------|--------------------------------------|
|      1 | User enters order             | User types: dialog or internet user  |
|      2 | Credit check request          | Communication protocol HTTPS or HTTP |
|      3 | Request external rating       | Communication protocol HTTPS or HTTP |
|      4 | Call up information provider  | Communication protocol HTTPS or HTTP |
|      5 | Provide external rating       | Not applicable                       |
|      6 | Use and store external rating | Not applicable                       |
|      7 | Credit check response         | Communication protocol HTTPS or HTTP |
|      8 | Inform user                   | Not applicable                       |
## 13.2.8.1.3  User Management
## Standard Users
This table shows the standard users that are necessary for operating SAP Credit Management .
| System                                 | User ID                   | Type               | Password                                                                                                                                | Description                                                                                                   |
|----------------------------------------|---------------------------|--------------------|-----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------|
| SAP Credit Management , client systems | For example, CREDITXIUSER | Communication user | You specify the initial password during the installation. The user ID and pass- word are stored in the XI channel for the con- nection. | This is required for communication be- tween SAP Credit Management and cli- ent systems using the XI channel. |
You need to create this user before XI configuration. Assign both roles SAP\_FIN\_FSCM\_CR\_USER and SAP\_XI\_IS\_SERV\_USER to the user. The user and password are added to the XI channel logon data that you create when you configure your exchange server.
## 13.2.8.1.5  Communication Destinations
## Use
This table shows an overview of the communication destinations (RFC) used by SAP Credit Management .
Connection Destinations when Using the Integration Server
| Destination        | Delivered   | User, Authorizations                  |
|--------------------|-------------|---------------------------------------|
| INTEGRATION_SERVER | No          | XIAPPLUSER Role SAP_XI_APPL_SERV_USER |
| LCRSAPRFC          | No          |                                       |
| SAPSLDAPI          | No          |                                       |
These destinations are not application-specific but they are required for the operation of SAP Process Integration.
For point to point connections via Web Services Reliable Messaging (WSRM), you use the SOA Manager in both systems to create the logical port and the endpoint.
## 13.2.8.1.6  Data Storage Security
## Use
Master and transaction data of SAP Credit Management are saved in the database of the SAP system in which SAP Credit Management is installed. They are not distributed to connected systems via XI, however they can be optionally extracted to SAP Business Information Warehouse.
Access to this data is restricted through the authorizations for authorization object F\_UKM\_SGMT . Authorizations for this authorization object are provided for role SAP\_FIN\_FSCM\_CR\_USER in the standard delivery; you can copy the role and adapt it as required. For more information about authorization object F\_UKM\_SGMT , see the configuration guide of SAP Credit Management .
Access to data on natural persons in particular is subject to data protection requirements and must be restricted by assigning authorizations.
## 13.2.8.1.7  Security-Relevant Logging and Tracing
## Use
All changes to the master data of SAP Credit Management are recorded as change documents in the business partner record. Changes automatically executed by the system as a follow-on process to an event appear under the name of the communication user if the event was triggered by an XI message.
## Example
A credit check is initiated by SD; the system detects that the validity date of the credit limit has expired and determines a new credit limit on the basis of the Customizing settings.
## 13.2.8.2  SAP Dispute Management
## 13.2.8.2.1  Technical System Landscape
## Use
You can use SAP Dispute Management in a one-system scenario or in a multiple-system scenario . If you use SAP Dispute Management in a one-system scenario, this means that you use SAP Dispute Management in the same system as Accounts Receivable . In a multiple-system scenario, you run SAP Dispute Management in a separate system. This communicates with the Accounts Receivable system connected by means of synchronous and asynchronous BAPI calls and dialog calls.
The figure below shows an overview of the technical system landscape for SAP Dispute Management in a one-system scenario.
<!-- image -->
The figure below shows an overview of the technical system landscape for SAP Dispute Management in a multiple-system scenario.
<!-- image -->
For SAP Dispute Management , with Business Package for Dispute Manager you can also use portal content to use the functions of SAP Dispute Management in the portal. For security-relevant information about using the portal content, see the ABAP Platform Security Guide for the usage types Enterprise Portal Core (EPC) and Enterprise Portal (EP) in the Portal security guide.
## 13.2.8.2.2  Security Aspects of Data, Data Flow, and Processes
The figure below shows an example of the data flow that occurs when you create a dispute case in a multiplesystem scenario:
<!-- image -->
The table below shows the security aspect to be considered for the process step and what mechanism applies.
|   Step | Description                                                                                     | Security Measure                                                                                                                    |
|--------|-------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
|      1 | User starts FI transaction (for example, FB03 for document display or FBL5N for line item list) | User type: Dialog user                                                                                                              |
|      2 | Dispute case is created asynchronously (IDoc/ALE)                                               | User type: Technical user or, when the Trusted/Trusting connection is used, di- alog user (see also User Administration [page 155]) |
As already mentioned under Technical System Landscape [page 153], SAP Dispute Management uses BAPI calls (IDocs) asynchronously for the data flow between the Accounts Receivable system and the Dispute Case Processing system. The following IDocs are affected:
- Sending system: Accounts Receivable Accounting, receiving system: Dispute Case Processing
- AttributesChange
- Create
- Process
- Sending system: Dispute Case Processing, receiving system: Accounts Receivable Accounting
- AttributeSynchronize
- StatusChanged
- WriteOff
If you are using SAP Dispute Management in a one-system scenario, synchronous BAPI calls are used instead.
## 13.2.8.2.5  Data Storage Security
## Use
Master data, transaction data, and Customizing data of SAP Dispute Management are stored in the database of the SAP system.
Access to the database is restricted by the authorization objects of SAP Dispute Management .
## 13.2.8.3  SAP Collections Management
## 13.2.8.3.1  Technical System Landscape
## Use
You can use SAP Collections Management in a one-system scenario or in a multiple-system scenario . If you use SAP Collections Management in a one-system scenario, this means that you use Collections Management in the same system as Accounts Receivable. In a multiple-system scenario, you run Collections Management in a separate system. This communicates with the Accounts Receivable system connected by means of synchronous and asynchronous RFC calls and dialog calls.
The figure below shows the technical system landscape in a one-system scenario :
<!-- image -->
The following figure shows the technical system landscape in a multiple-system scenario :
<!-- image -->
If you connect several FI systems in a multiple-system scenario but have not installed a central system for processing customer master data, then you can resolve conflicts when assigning numbers with the connection of Unified Key Mapping Service to SAP Process Integration (UKMS connection to SAP Process Integration ).
The figure below shows the technical system landscape in a multiple-system scenario with several FI systems :
<!-- image -->
For additional information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Connecting to SAP Process Integration into the search bar, press Enter , and open the search result with that title.
## 13.2.8.3.2  Security Aspects of Data, Data Flow, and Processes
The following sections show an overview of the data flow in a multiple-system scenario.
## 13.2.8.3.2.1  Transfer of Transaction Data
The figure below shows the transfer of transaction data, meaning FI items, from the Accounts Receivable (FI-AR) system to the Collections Management system. This is data that the system needs for creating the worklists.
<!-- image -->
The table below shows the security aspect to be considered for the process step and what mechanism applies.
|   Step | Description                                                   | Security Measure                                                                                      |
|--------|---------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|
|      1 | The administrator schedules the job.                          | User type: Dialog user                                                                                |
|      2 | Program FDM_COLL_SEND_ITEMS transfers the FI items (IDoc/ALE) | User type: Technical user or, when the Trusted/Trusting connection is used, di- alog user (see also ) |
## 13.2.8.3.2.2  Processing of Items in the Worklist
The figure below shows how a collection specialist processes an item in his worklist, so creating a promise to pay.
<!-- image -->
The table below shows the security aspect to be considered for the process step and what mechanism applies.
|   Step | Description                                                                   | Security Measure                                                                          |
|--------|-------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
|      1 | The collection specialist call up the worklist (transaction UDM_SPECIAL- IST) | User type: Dialog user                                                                    |
|      2 | He then navigates to receivables proc- essing (synchronous RFC connection)    | User type: Dialog user                                                                    |
|      3 | He creates a promise to pay with asyn- chronous BAPI (IDoc/ALE)               | User type: Technical user or, when the Trusted/Trusting connection is used, di- alog user |
## 13.2.9  SAP S/4HANA Financial Closing cockpit
## 13.2.9.1  Authorizations
The SAP S/4HANA Financial Closing cockpit uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the AS ABAP Security Guide also apply to the SAP S/4HNA Financial Closing cockpit .
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the AS ABAP and the User Management Engine's user administration console on the AS Java.
For more information about how to create roles, go to the SAP Help Portal and search for User and Role Administration of Application Server ABAP . There, go to Configuration of User and Role Administration Role Administration
## Authorizations for Business Intelligence (BI) iViews
BI authorizations are maintained separately from the authorizations in the SAP S/4HANA Financial Closing cockpit . Y ou need the standard BI authorizations for executing queries.
For more information, go to the SAP Help Portal and search for Data Warehouse Management . There, go to Authorizations Authorizations for Working with Queries .
## 13.2.10  Travel Management
## 13.2.10.2  Deletion of Personal Data in FI-TV
## Use
The Travel Management (FI-TV) component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
<!-- image -->
For information, see SAP Note 2028594 .
## Relevant Application and Available WUC functionality
| Application                 | Implemented Solution   | Further Information   |
|-----------------------------|------------------------|-----------------------|
| Travel Expenses (FI-TV-COS) | Where-used check (WUC) | SAP Note 2028595      |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
## 13.2.11  Incentive and Sales Force Management
## Purpose
Incentive and Sales Force Management (ISF) offers a range of security-related functions to handle your security requirements. In addition to the specific Incentive and Sales Force Management topics, see also the SAP Security Guide [page 174] that covers the SAP security standard as a whole.
## Features
Here you find all of the security topics related to Incentive and Sales Force Management and links to the relevant sections in the SAPSecurity Guide.
Introduction [page 174]
Before You Start [page 174]
User Management and Authentication [page 175]
Authorization Management in Incentive and Sales Force Management [page 180]
Network and Communication Security [page 220]
Virus Protection [page 221]
Data Protection [page 221]
<!-- image -->
Revision Security in Incentive and Sales Force Management [page 226]
Procedure Documentation in Incentive and Sales Force Management [page 227]
## 13.2.11.1  Introduction
##  Caution
This guide does not replace the administrative or operational guides that are available for the productive operation.
## Target Group
- Technology consultants
- System administrators
This document is not included as part of the Installation Guides, Configuration Guides, Technical Operation Manuals, or Upgrade Guides. Such guides are only relevant for a certain phase of the software life cycle, whereby the Security Guides provide information that is relevant for all life cycle phases.
## The Need for Security
With the increasing use of distributed systems and the Internet for managing business data, the demands on security are also on the rise. When using a distributed system, you need to be sure that your data and processes support your business needs without allowing unauthorized access to critical information. User errors, negligence, or attempted manipulation of your system must not result in loss of information or processing time. These security requirements equally apply to Incentive and Sales Force Management. We provide this Security Guide to assist you in securing your application.
## 13.2.11.2  Before You Start
## Security Guides Referenced
Incentive and Commission Management is based on the technology of SAP NetWeaver.
Consequently you should refer to the Security Guide of SAP NetWeaver on the SAP Help Portal under the Internet address help.sap.com Documentation SAP NetWeaver Release/Language SAP NetWeaver Security SAP NetWeaver Security Guide.
To view all of the SAP security guides, see the SAP Service Marketplace under the Internet address service.sap.com/securityguide.
## Important SAP Notes
SAP Note 138498 contains information on single sign-on solutions.
For further SAP notes on security, see the SAP Service Marketplace under the Internet address service.sap.com/security SAP Security Notes .
## Additional information
For more information about specific topics, see the sources in the table below.
Additional Information
## Contents
## Quick Link to SAP Service Marketplace
| Security                                      | service.sap.com/security                |
|-----------------------------------------------|-----------------------------------------|
| Security guides, SAP NetWeaver security guide | service.sap.com/securityguide           |
| SAP NetWeaver documentation                   | help.sap.com Documentation SAPNetWeaver |
| Related SAP notes                             | service.sap.com/notes                   |
## 13.2.11.3  User Management and Authentication
## Use
Incentive and Sales Force Management uses the user administration and authentication mechanisms of the SAP NetWeaver platform, and in particular the SAP NetWeaver Application Server. Therefore, the security recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver AS Security Guide for ABAP Technology also apply to ISF.
Setting up users and assigning roles to user master data records are basic prerequisites for starting up an SAP system. Secure authentication protects the system against unauthorized users and the related security risks. ISF takes into account the SAP security standards for user authentication.
##  Note
For more information, see
- SAP Help Portal under the Internet address help.sap.com Documentation SAP NetWeaver Release/LanguageSAP NetWeaver Security User Authentication and Single Sign-On
- or SAP Service Marketplace under the Internet address service.sap.com/security Security in Detail SAP Security Guides SAP Basis / Web AS Security Guides
## - User Authentication
## - SAP Authorization Concept
In addition to these guidelines, we include information about user administration and authentication that specifically applies to ISF in the following topics:
## User Administration
This section lists the tools to use for user administration, the types of users required, and the standard users that are delivered with ISF.
## Integration in Single Sign-On Environments
This section describes how ISF supports single sign-on mechanisms.
## 13.2.11.3.2  Integration in Single Sign-On Environments
Incentive and Sales Force Management supports the single sign-on mechanisms (SSO mechanisms) of the SAP Netweaver Application Server. Therefore, the security recommendations and guidelines for user administration and authentication as described in the Security Guide for SAP NetWeaver Application Server also apply to Incentive and Sales Force Management.
The supported mechanisms are listed below.
## Secure Network Communications (SNC)
SNC is available for user authentication and provides for an SSO environment when using the SAP GUI for Windows or Remote Function Calls.
For more information, see SAP Service Marketplace at service.sap.com/securityguide SAP NetWeaver Security Guide Security Guides for the SAP NetWeaver Products SAP NetWeaver Application Server Security Guide SAP NetWeaver AS Security Guide for ABAP Technology User Authentication Authentication and Single Sign-On Secure Network Communications (SNC).
## SAP Logon Tickets
ISF supports the use of logon tickets for SSO when using a Web browser as the front-end client. In this case, users can be issued a logon ticket after they have authenticated themselves with the initial SAP system. The
ticket can then be submitted to other systems (SAP or external systems) as an authentication token. The user does not need to enter a user ID or password for authentication but can access the system directly after the system has checked the logon ticket.
For more information, see the SAP Web Application Server under SAP Logon Tickets .
## Client Certificates
As an alternative to user authentication using a user ID and passwords, users using a Web browser as a frontend client can also provide X.509 client certificates to use for authentication. In this case, user authentication is performed on the Web server using the Secure Sockets Layer Protocol (SSL Protocol) and no passwords have to be transferred. User authorizations are valid in accordance with the authorization concept in the SAP system.
For more information, see Client Certificates in the SAP NetWeaver Application Server security guide.
## 13.2.11.4  Authorization Management in Incentive and Sales Force Management
## Use
The authorization concept comprises the structure and functions of authorization assignment and authorization checks in the SAP system.
Having authorization means that you can execute a certain action in the SAP system.
Each authorization refers to an authorization objectand defines one or more values for each authorization field contained in the authorization object. Authorizations are summarized in profiles, which are entered in the user's master data.
## Integration
In the environment of Incentive and Sales Force Management , the two main areas that you should protect against unauthorized access by implementing an authorization concept are the commission agreements and the commission database. For more information on agreements, go to the product assistance for SAP S/4HANA, choose your release and then Product Assistance Enterprise Business Applications Finance Incentive and Sales Force Management Incentive and Commission Management Master Data Commission Contracts Agreements .
You can also use authorization objects to control the credentials to execute certain actions.
## Prerequisites
Before you can assign authorization profiles in Incentive and Sales Force Management , you must have system administrator authorization for your system.
## Features
To be able to work with an application (ICM or CRD), the user needs authorization for each application.
Within the application itself, the functions and menu options that users can select might depend on different user profiles that are assigned to the user.
All menu options are displayed in the ISF menu. The authorization check does not take place until the user tries to call a transaction via a menu option. If the user does not have authorization for the transaction in question, the system issues a corresponding error message.
Authorizations in ISF are classed as quantifying , qualifying , or structural [page 212] authorizations.
## Quantifying Authorization Groups
You can group quantifying authorizations into authorization groups.
## Qualifying Authorization Profiles
You control qualifying authorizations with the help of commission-specific authorization profiles .
## Structural Authorizations
You map structural authorizations by creating appropriate links in Organizational Management.
Company-specific specifications govern the assignment of authorizations, in other words, who is given which authorization for which object. This means that authorizations can be derived from the position of the person in the company hierarchy.
<!-- image -->
##  Example
Commission contract partner A can only view their own data and that of their subordinates.
Commission contract partner B can only see their own data.
Commission contract partner C can only see data from their subordinates.
## 13.2.11.4.1   Authorization profile
## Use
Authorization profiles give users access to the system. They contain authorizations that are identified by the name of an authorization object and the name of an authorization. If the system administrator enters a profile in the user master record, then the user is assigned all the authorizations contained in the profile.
## Prerequisite
You maintain authorizations for the whole commission application centrally. To do so, you need administrator authorization in your SAP system. In Incentive and Commission Management, there is an authorization profile for every authorization object.
## Features
A profile can be a single profile or a collective profile.
- Single profiles contain authorizations. Each authorization is identified by the name of an authorization object and the name of the authorization that was created for the object.
- Collective profiles contain other profiles. A collective profile gives the user all single or collective profiles contained therein. To get all the superuser authorizations, select the composite profile SAP\_ICM\_C\_SUSER .
##  Note
For additional information on the authorization profile, see the SAP Library under mySAP Technology Components -&gt;SAP WEB Application Server-&gt; Security (BC-SEC) -&gt; Users and Roles (BC-SEC-USR).