orkungedik/SAP-basis-dataset huggingface dataset:
## 13.13.4.1.1.1  Authorizations
You create roles in Customizing for SAP Banking under SAP Business Partner for Financial Services General Settings Business Partner Basic Settings Authorization Management .
The authorization objects are the responsibility of the SAP Business Partner . SAP Financial Customer Information Management (FS-BP) is only responsible for the following authorization objects:
- T\_BP\_DEAL ( Standing Instructions/Transactions) You can use this authorization object to control the company code-dependent authorizations for displaying/creating/changing standing instructions.
There are standing instructions for:
- Payment details
- Derived flows
- Correspondence
- Transaction authorizations
- B\_BUPA\_SLV ( Selection Variant for Total Commitment )
A selection variant includes various settings for the total commitment (such as which business partner roles and relationships can be used for the selection, or whether detailed information can be displayed).
If you activate the SACF scenario FSBP\_RATINGS ( FS-BP: Scenario for Ratings and Credit Standing Data ) in the Workbench for Switchable Authorization Check Scenarios (transaction SACF ), the following FS-BP authorization objects are also available:
- B\_BUPA\_RAT ( Business Partner: Ratings ) You can use this authorization object to check whether a user has the authorization to create, change, display, or delete rating procedures. For each rating procedure, you can differentiate between an authorization for a permitted period or an authorization for any period. The prerequisite for this is that you have made the settings for the periods in Customizing for SAP Banking under SAP Business Partner for Financial Services Settings for Financial Services General Settings Ratings/Credit Standing Ratings Set Rating Procedures and Ratings .
- B\_BUPA\_CRS ( Business Partner: Credit Standing Data )
You can use this authorization object to check whether a user has the authorization to display and change credit standing data.
## 13.13.4.1.1.2  Network and Communication Security
In the case of Total Commitment , SAP ERP communicates with other SAP systems (such as Account Management (FS-AM)). Communication with non-SAP systems is also possible.
Communication takes place using Remote Function Call (RFC).
## 13.13.4.1.1.2.1  Communication Destinations
Depending on the scenario, an RFC user is required for communication via Remote Function Call (RFC). This user requires the appropriate authorizations for the target system (such as FS-CML or FS-AM).
## 13.13.4.1.1.3  Data Protection
The data protection concept with SAP Business Partner for Financial Services (FS-BP) is very similar to the data protection concept with the central SAP Business Partner (SAP BP).
## Integration with Agent Framework (FS-FND-AF)
SAP Business Partner for Financial Services can be used in conjunction with the Agent Framework to provide other participating applications with all changes made to business partner master data. The Agent Framework uses the Change Notification Service (CA-GTF-TS-CNS) and adds to it.
If you made the necessary settings in Customizing, the CNS generates so-called change pointers for each change made to a business partner. These change pointers can then be processed by the Agent Framework which sends the updated information to the participating applications. In addition to the change pointers, the system generates an image of the export object. These images are stored in table FSBP\_CNS\_IMAGE and contain personal data of the corresponding business partner. For data privacy reasons, you have to delete the processed change pointers regularly. You should therefore schedule a regular job to call one of the two deletion reports CNS\_CP\_DELETE or CNS\_CP\_DELETE\_MULT .
## More Information
For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ / help.sap.com/s4hana\_op\_2021 and go to
- Cross Components Data Protection .
## 13.13.4.1.1.4  Data Storage Security
The authorization object B\_CCARD controls access to the credit card information that is stored in the business partner. This control falls under the area of responsibility of the central SAP Business Partner .
You can use authorization groups (authorization object B\_BUPA\_GRP ) to protect employee data.
If you activate the SACF scenario FSBP\_RATINGS ( FS-BP: Scenario for Ratings and Credit Standing Data ) in the Workbench for Switchable Authorization Check Scenarios (transaction SACF ), the following FS-BP authorization objects are also available:
- B\_BUPA\_RAT ( Business Partner: Ratings )
- B\_BUPA\_CRS ( Business Partner: Credit Standing Data )
## 13.13.4.1.2  Bank Customer Accounts (BCA)
## 13.13.4.1.2.1  Authorizations
The following standard roles are available in Bank Customer Accounts (BCA) , for example:
| Role                          | Description                                           |
|-------------------------------|-------------------------------------------------------|
| SAP_ISB_ACCOUNTS_ADMIN_AG     | SAP Banking BCA: Administrator in Account Management  |
| SAP_ISB_ACCOUNTS_ASSISTANT_AG | SAP Banking BCA: Assistant in Account Management      |
| SAP_ISB_ACCOUNTS_STAFF_AG     | SAP Banking BCA: Clerical Staff in Account Management |
##  Note
These standard roles are only samples and not suitable for operative usage.
## Standard Authorization Objects
You can find the authorization objects and the related documentation in the system using transaction SU21 under the object class IS\_B Industry-Specific Solutions - Bank .
For more information on authorization management and the authorization objects in Bank Customer Accounts , see the product assistance documentation, under Enterprise Business Applications Finance SAP Banking Bank Customer Accounts (BCA) General Subjects Authorization Administration Authorization Objects .
Bank Customer Accounts (BCA) also contains the following business transaction events on the subject of authorizations:
| Business Transaction Event   | Description                                         |
|------------------------------|-----------------------------------------------------|
| SAMPLE_INTERFACE_00011040    | AUTH1 account                                       |
| SAMPLE_INTERFACE_00011700    | Authorization checks in the information system      |
| SAMPLE_INTERFACE_00011701    | Authorization check in the information system (RFC) |
| SAMPLE_INTERFACE_00010950    | Check management                                    |
| SAMPLE_INTERFACE_00010210    | Payment item dialog                                 |
| SAMPLE_INTERFACE_00010410    | Payment order dialog                                |
| SAMPLE_INTERFACE_00010411    | Standing order dialog                               |
## 13.13.4.1.2.2  Network and Communication Security
The table below shows the communication channels between systems used by Bank Customer Accounts (BCA) :
| Communication Path                                                | Protocol Used   | Type of Data Transferred   | Data Requiring Special Pro- tection   |
|-------------------------------------------------------------------|-----------------|----------------------------|---------------------------------------|
| Front-end client with SAP GUI for Windows to applica- tion server | DIAG            | All application data       | Password, personal data               |
| Application server to applica- tion server                        | RFC             | All application data       | Personal data (e.g. account balances) |
| Application server to applica- tion server                        | SOAP            | All application data       | Personal data (e.g. account balances) |
DIAG and RFC connections can be protected using Secure Network Communications (SNC). HTTP connections are protected using the Secure Sockets Layer (SSL) protocol. SOAP connections are protected with Web services security.
##  Recommendation
We recommend that you use secure protocols (SSL, SNC) whenever possible.
For more information, see Transport Layer Security and Transport Security for Web Services in the ABAP Platform Security Guide.
Since Bank Customer Accounts (BCA) is based on SAP NetWeaver technology, for more information about network security see the SAP NetWeaver Security Guide at Network and Communication Security .
If you offer services on the Internet, you need to protect your network infrastructure with at least a firewall. You can increase the security of your system (or group of systems) by creating the groups in different network segments, each of which is protected from unauthorized access by a firewall.
##  Caution
Remember that unauthorized access can also come from inside if an intruder has already taken control of one of your systems.
## Ports
BCA runs on SAP NetWeaver and uses ports from the AS ABAP or AS Java.
For more information, see Ports of SAP NetWeaver Application Server for ABAP and AS JAVA Ports in the SAP NetWeaver Security Guide .
## 13.13.4.1.2.3  Deletion of Personal Data in IS-B-BCA
## Use
The Bank Customer Accounts (IS-B-BCA) component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application   | Detailed Description                                                                                  | Provided Deletion Functionality                                                                                                                                                                                                                                          |
|---------------|-------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| BKK           | For more information, see SAP Note 2023415 .                                                          | BKK_BUPA_EVENT_EOP_CHECK ILM object FIBA_BUPA                                                                                                                                                                                                                            |
| BKK           | For more information, see Archiving or Destroying Bank Customer Accounts Data, and SAP Note 2023417 . | ILM objects: • BKKPRENOTE • FIBA_ACCNT • FIBA_BKST • FIBA_CFBAL • FIBA_EFTEX • FIBA_EFTIN • FIBA_ENRCH • FIBA_EVLIM • FIBA_GL • FIBA_GLBAL • FIBA_HIERA • FIBA_HOLD • FIBA_INCAL • FIBA_ITEM • FIBA_ORDER • FIBA_PECAL • FIBA_PXPO • FIBA_STORD • FIBA_TERM • FIBA_TOTAL |
## Available Check
Implemented Solution: End of Purpose Check
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
## 13.13.4.1.2.4  Specific Read Access Log Configurations
## Use
In Read Access Logging (RAL), you can configure which read-access information to log and under which conditions. SAP delivers sample configurations for applications.
The scenario Payment Document Display/Change/Create (Tx WZR(1/2/3)) in Settlement Management (LO-AB) logs data in order to record any access to banking data related to a customer or a vendor. You can find the configurations as described in the Read Access Logging [page 33] chapter.
In the following configurations, fields are logged in combination with additional fields, in the following business contexts:
| Configuration   | Fields Logged   | Business Context                            |
|-----------------|-----------------|---------------------------------------------|
| LOAB_BANK       | KOMWBRD-BANKL   | Bank Keys                                   |
| LOAB_BANK       | KOMWBRD-BANKN   | Bank account number                         |
| LOAB_BANK       | KOMWBRD-BANKS   | Bank country key                            |
| LOAB_BANK       | KOMWBRD-BKONT   | Bank country key                            |
| LOAB_BANK       | KOMWBRD-BKREF   | Reference specifications for bank de- tails |
| LOAB_BANK       | KOMWBRD-DTAMS   | Instruction key for data medium ex- change  |
| LOAB_BANK       | KOMWBRD-DTAWS   | Indicator for Data Medium Exchange          |
## 13.13.4.1.2.5  Change Log
Personal data is subject to frequent changes. Therefore, for review purposes or as a result of legal regulations, it may be necessary to track the changes made to this data. When these changes are logged, you should be able to check which employee made which change, the date and time, the previous value, and the current value, depending on the configuration. It is also possible to analyze errors in this way. In Bank Customer Accounts (BCA) this is implemented via change document functionality.
For more information about Change Documents , choose the relevant SAP NetWeaver version and open the following documentation:
Under Application Help , go to SAP NetWeaver Library : Function-Oriented View Application Server Application Server ABAP Other Services Services for Application Developers Change Documents .
## 13.13.4.1.2.6  Dual Control
To increase the security standard you should activate the principle of dual control.
The following is a list of the relevant objects and the corresponding activity in the Customizing of Current Account System : Bank Customer Accounts (BCA) , where you can set the indicator for the dual control.
##  Note
The principle of dual control is not activated in the standard system.
| Object              | Customizing Activity                                                   |
|---------------------|------------------------------------------------------------------------|
| Account             | Dual Control for Master Data                                           |
| Account Balancing   | Currency Changeover at Account Balancing and Principle of Dual Control |
| Account Closure     | Master Data Account Account Closure Release Assign ...                 |
| Account Hierarchies | Activate Release Relevance for Account Hierarchies                     |
| Conditions          | Enter Basic Settings for Conditions                                    |
| Forward Order       | Account Management Release Release Forward Orders Assign …             |
| Forward Order       | Maintain Amount Limit/Principle of Dual Control for Pay- ment Order    |
| Hold Amount Limit   | Maintain Hold Amount Limit/Principle of Dual Control                   |
| Limits              | Maintain Principle of Dual Control for Limits                          |
| Notice on Amount    | Dual Control for Notice Management                                     |
| Object         | Customizing Activity                                                             |
|----------------|----------------------------------------------------------------------------------|
| Payment Order  | Account Management Release Release Payment Orders Assign …                       |
| Payment Item   | Account Management Release Release Payment Items Assign …                        |
| Payment Item   | Maintain Amount Limit/Principle of Dual Control for Pay- ment Item               |
| Prenote        | Account Management Maintain Prenotes Release Assign …                            |
| Standing Order | Account Management Release Release Standing Orders With Fixed Amount Assign …    |
| Standing Order | Account Management Release Release Standing Orders With Variable Amount Assign … |
| Standing Order | Maintain Amount Limit/Principle of Dual Control for Stand- ing Order             |
## 13.13.4.1.3  Loans Management (FS-CML)
## 13.13.4.1.3.2  Network and Communication Security
Loans Management (FS-CML) does not communicate with other systems.
The only exception is the loan origination process. In this process, CRM serves as the entry system, and FS-CML as the back-end system. Communication takes place by means of XI.
## 13.13.4.1.3.4  Deletion of Personal Data in FS-CML
## Use
The Consumer Mortgage Loans (FS-CML) component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application Object   | Detailed Description        | Provided Deletion Functionality                                                               |
|----------------------|-----------------------------|-----------------------------------------------------------------------------------------------|
| CMLCONTRCT           | Loan Master Data            | Archiving object CMLCONTRCT ILM object CMLCONTRCT                                             |
| CMLMODCALC           | Model Calculation           | Archiving objectCMLMODCALC ILM objectCMLMODCALC                                               |
| CMLCRSTND            | Credit Standing Calculation | Destruction object CML_CRSTAND- CALC_DESTRUCTION ILM object CML_CRSTANDCALC_DE- STRUCTION     |
| CMLINTPAR            | Interested Party            | Destruction object CML_INTEREST- PARTY_DESTRUCTION ILM object CML_INTERESTPARTY_DE- STRUCTION |
| CMLCOLLATE           | Collaterals                 | Destruction object CMLCOLLATE ILM object CMLCOLLATE                                           |
| CMLCOLOBJ            | Collateral Objects          | Destruction object CMLCOLOBJ ILM object CMLCOLOBJ                                             |
## Relevant Application Objects and Available EoP functionality
| Application Object   | Implemented Solution (End of Pur- pose Check)   | Further Information              |
|----------------------|-------------------------------------------------|----------------------------------|
| CMLCONTRCT           | Loan Master Data                                | FLBP_CONTR_EVENT_EOP_CHECK       |
| CMLMODCALC           | Model Calculation                               | FLBP_MODEL- CALC_EVENT_EOP_CHECK |
| CMLCRSTND            | Credit Standing Calculation                     | FLBP_CR_STND_EVENT_EOP_CHECK     |
| CMLINTPAR            | Interested Party                                | FLBP_INT_PAR_EVENT_EOP_CHECKN    |
| CMLCOLLATE           | Collaterals                                     | FLBP_COLLTRL_EVENT_EOP_CHECK     |
| CMLCOLOBJ            | Collateral Objects                              | FLBP_COLLOBJ_EVENT_EOP_CHECK     |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
## 13.13.4.1.4  Collateral Management (CM)
## Purpose
The purpose of this guide is to explain the security-specific features built-in for the SAP Collateral Management ( CM ).
To understand the security features provided in CM, you must read the Application Server ABAP security guide that describes the basic security aspects and measures for SAP systems.
## 13.13.4.1.5  Reserve for Bad Debt (FS-RBD)
Please Note: Monitor System Storage before file import and restrict access authority for RBD file upload.
## 13.13.4.1.5.2  Network and Communication Security
Depending on the risk provision method used and analysis horizon, the Reserve for Bad Debt (FS-RBD) application communicates with the following systems:
- SAP Loans Management for Banking, Suite Edition (FS-CML)
- SAP Deposits Management for Banking, Suite Edition (IS-B-BCA)
- SAP Deposits Management for Banking (FS-AM)
- SAP Collateral Management for Banking, Suite Edition (FS-CMS)
- SAP General Ledger Accounting (FI-GL)
Communication takes place using Remote Function Call (RFC). Please use sparate users / passwords for RFC an Web services. Also do not use technical users because of better tracability.
RBD Area
Not relevant
Not relevant
Not relevant
## 13.13.4.1.5.2.1  Communication Destinations
For Remote Function Call (RCF) connections to SAP Deposits Management for Banking (FS-AM) , technical users are required.
These technical users require read authorization, for example, to read balances and account master data. Please use sparate users / passwords for RFC an Web services. Also do not use technical users because of a better tracability.
## 13.13.4.1.5.3  Deletion of Personel Data in FS-RBD
## Use
The Reserve for Bad Debts (FS-RBD) component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application Object   | Detailed Description             | Provided Deletion Functionality                  |
|----------------------|----------------------------------|--------------------------------------------------|
| /IBX/CONTR           | Contract Header Data             | Archiving object /IBX/CONTR ILM object IBX_CONTR |
| /IBX/VALUA           | IPX Valuation                    | Archiving object /IBX/VALUA ILM object IBX_VALUA |
| /IBS/RBECO           | RBDTransaction Data ECF          | Archiving object /IBS/RBECO ILM object RBCON_ECF |
| /IBS/RBHCO           | RBDTransaction Data Past Horizon | Archiving object /IBS/RBHCO ILM objectRBCON_HGB  |
| /IBS/RBKTO           | RBDAccount Data                  | Archiving object /IBS/RBKTO ILM object RBKTO_ECF |
## Relevant Application Objects and Available EoP functionality
| Application Object   | Implemented Solution (End of Pur- pose Check)                | Further Information          |
|----------------------|--------------------------------------------------------------|------------------------------|
| /IBX/CONTR           | EOP check of contract header data based on contract end date | /IBX/CONTR_BUPA_EOP_CHECK    |
| /IBX/VALUA           | EOP check of contract header data based on contract end date | /IBX/CONTR_BUPA_EOP_CHECK    |
| /IBS/RBECO           | EOP check of contract header data based on contract end date | /IBS/RB_CONTR_BUPA_EOP_CHECK |
| /IBS/RBHCO           | EOP check of contract header data based on contract end date | /IBS/RB_CONTR_BUPA_EOP_CHECK |
| /IBS/RBKTO           | EOP check of contract header data based on contract end date | /IBS/RB_CONTR_BUPA_EOP_CHECK |
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
## 13.13.4.1.5.4  Specific Read Access Log Configurations
## Use
In Read Access Logging (RAL), you can configure which read-access information to log and under which conditions. SAP delivers sample configurations for applications.
The RBD Reporting Interface /IBS/RB\_IS\_REPORTING\_RFC logs fields with sensitive customer data in the specified log domains.
You can configure your individual log domains, which contain individual fields with sensitive customer data, using the Read Access Logging Guide.
You can find the configurations as described in the following chapter. Read Access Logging [page 33]
In the following example configurations, fields are logged in combination with additional fields, in the following business contexts:
| Interface Name             | Fields Logged                         | Log Domain   | Business Context   |
|----------------------------|---------------------------------------|--------------|--------------------|
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_KTO-RBDID /IBS/TRB_KTO-RBDNR | RBD_ACCID    | RBDaccount number  |
| Interface Name             | Fields Logged                                 | Log Domain   | Business Context                     |
|----------------------------|-----------------------------------------------|--------------|--------------------------------------|
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_KTO-REFNR                            | RBD_ACCREF   | RBDaccount reference                 |
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_KVV-PARTV                            | RBD_PARTV    | Partner Reference Source System      |
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_KVV-VERTV                            | RBD_VERTV    | Contract Number Source System        |
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_KVV-FINRV                            | RBD_FINRV    | Finance Project Number Source System |
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_ECF_HD- RBDID /IBS/TRB_ECF_HD- RBDNR | RBD_ACCID    | RBDaccount number                    |
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_KVV-VERTV /IBS/TRB_ECH_HD- RBDNR     | RBD_VERTV    | Contract Number Source System        |
| /IBS/RB_IS_REPORT- ING_RFC | /IBS/TRB_ECH_HD- VERTV                        | RBD_VERTV    | Contract Number Source System        |
## More Information
For more information about the RAL sample Customizing for FS-RBD, see SAP Note 2519373 .
## 13.13.4.1.5.5  Trace and Log Files
Trace or log files are created during processing. These can contain security-relevant information - such as master data, balances, and flow data from source system contracts.
## 13.13.4.2  Insurance
## 13.13.4.2.1  Claims Management
With Claims Management for Insurance, you can manage the entire claims process, from first notifcation of loss to claims adjustment and financial reporting.
## 13.13.4.2.1.1  Data Storage Security
## Using Logical Path and File Names to Protect Access to the File System
SAP Claims Management save data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The following list shows the logical file names and paths used by SAP Claims Management and for which programs these file names and paths apply:
## Logical File Names Used in SAP Claims Management
The following logical file names have been created in order to enable the validation of physical file names:
- ICLVEH
- Program using this logical file name and parameters used in this context: ICL\_VEHCATALOG\_UPLOAD
- Customizing path: SAP Insurance Claims Management Claim Business Settings Damaged Objects/Diagnoses Damaged Objects/Injured Persons Import Catalog for Insured Objects
- ICLDIAG
- Program using this logical file name and parameters used in this context: ICL\_DIAG\_UPLOAD
- Customizing path: SAP Insurance Claims Management Claim Business Settings Damaged Objects/Diagnoses Damaged Objects/Injured Persons Diagnoses Import Diagnosis Groups and Diagnoses
- ICLSUPPL
- Program using this logical file name and parameters used in this context: ICL\_ICLCLAIMDATA\_UPLOAD
- ICLDI
- Program using this logical file name and parameters used in this context: ICL\_DATA\_UP\_DOWNLOAD
## Activating the Validation of Logical Path and File Names
These logical paths and file names, as well as any subdirectories, are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent)
and SF01 (client-specific). T o find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log.
## 13.13.4.2.1.2  Data Protection
## 13.13.4.2.1.2.1  Read Access Logging
In Read Access Logging, you can configure which read-access information to log and under which conditions. In the following table, you can find the configurations (shipped with SAP Claims Management), the fields are logged, and the relevant business context:
| Configuration   | Fields Logged                                                                                                                  | Business Context                                                                                                                                                |
|-----------------|--------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ICL_SSN         | • Tax Number Category (field TAXTYPE in for instance table ICLC_ICL_BP_MINI_SCREEN- ) • Business Partner Tax Number ( TAXNUM ) | SAP Claims Management logs tax data.  Note In the Mini Business Partner the tax number is only logged if the user has selected the tax number cate- gory US1 . |
| ICL_BANK        | • Bank details ID ( BKEXT ) • Bank country key ( BANKS ) • Bank Key ( BANKL ) • Bank account number ( BANKN ) • IBAN ( IBAN )  | SAP Claims Management logs bank ac- count data.                                                                                                                 |
| Configuration   | Fields Logged                                                                                                                                                                                                                                                                                                                                         | Business Context                        |
|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------|
| ICL_HEALTH      | The fields in the following categories are logged: • Claim item groupings and the rele- vant items with subclaim type, cov- erage, coverage type, benefit type, benefits catalog • Diagnosis • Procedures • Tooth notation and eyeglass pre- scription • Level of care • Suspension of care • Insured persons and claimant • Facts capture • Payments | SAP Claims Management logs health data. |
For Read Access Logging of health data, you have to activate specific views in Customizing for SAP
Insurance under Claims Management Claim Technical Settings Data Protection Read Access Logging Activate Specific Views for Read Access Logging .
## 13.13.4.2.1.2.2  Deletion of Personal Data
SAP Claims Management might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application Object                                       | Provided Deletion Functionality              |
|----------------------------------------------------------|----------------------------------------------|
| Archiving of Claims (Archiving Object ICLCLAIM )         | ILM Object ICLCLAIM (see SAP Note 1976123 )  |
| Archiving of Claim Bundles (Archiving Object ICLECCEVT ) | ILM Object ICLECCEVT (see SAP Note 1976123 ) |
| Application Object           | Provided Deletion Functionality   |
|------------------------------|-----------------------------------|
| Archiving of Subclaims       | ILM Object ICLSUBCL               |
| (Archiving Object ICLSUBCL ) |                                   |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
- Define the settings for authorization management in Customizing for Cross-Application Components under Data Protection Authorization Management . For more information, see the Customizing documentation.
- Define the settings for blocking in Customizing for Cross-Application Components under Data Protection Blocking and Unblocking Business Partner .
You configure the settings related to the blocking and deletion of customer master data in Customizing for SAP Insurance under Claims Management Claim Technical Settings Archiving .
## 13.13.4.2.1.2.3  Change Log
In order to log personal data in FS-CM, you can use the following standard function of FS-CM:
- Log of changes in a claim and in a claim bundle When you are processing a claim or a claim bundle, you can view a structured overview showing the changes in the relevant claim or claim bundle. To call up the structured change overview, choose Tools Claim Changes (Overview) in claim processing, or Tools Bundle Changes (Overview) in claim bundle processing. In the next dialog screen you see the overview tree with the changes that have been made. For more information, see Application Help of SAP Claims Management under Claim Administration of the Claims Management System Display of Changes in Claim and Claim Bundle .
##  Note
Changes of business partner data will be logged in the business partner system since business partner data are not stored in FS-CM.
## 13.13.4.2.1.2.4  Information Retrieval
Claims Management uses the Information Retrieval Framework (IRF) to retrieve information about the business partner data that is stored in claims. For more information, see SAP Note 2690400 .
## 13.13.4.2.1.2.5  User Consent
It is the responsibility of insurance companies themselves to obtain the consent of all of their business partners with regard to the use of their personal data.
## 13.13.4.2.2  Policy Management
With Policy Management, you can manage insurance contracts. You can map the whole life cycle of a contract, starting from the creation of an application, through policy issuance and ongoing contract maintenance, right up to the termination of the contract.
## 13.13.4.2.2.3  Data Protection and Privacy
## 13.13.4.2.2.3.1  Read Access Logging
In Read Access Logging (RAL), you can configure which read-access information to log and under which conditions. Policy Management delivers the following sample configurations:
- Configuration for bank details
- Configuration for payment cards
- Configuration for health data
- Configuration for policy number
For more information, see SAP Note 2630769 .
##  Note
Regarding the Fiori app Policy Inquiry :
Since the Fiori app Policy Inquiry is not directly RAL-enabled you must activate RAL indirectly via the corresponding OData service UI\_POLICYINQUIRY .
## 13.13.4.2.2.3.3  Change Log
To log personal data, you can use the following standard functions of Policy Management:
- Log of changes in contract journal
- Scrolling in journal
- Changes to a policy displayed in the policy summary
- Changes to a contract displayed in the contract summary
##  Caution
Changes to business partner data are logged in the business partner component since business partner data is not stored in Policy Management.
## 13.13.4.2.2.3.5  User Consent
It is the responsibility of insurance companies themselves to obtain the consent of all of their business partners with regard to the use of their personal data.
## 13.13.4.2.2.4  Connected Product Engine
Policy Management uses a product engine to check the actuarial aspects of the policy and to perform calculations. You can guarantee the security of the product engine system by using suitable user authorizations at operational level. Y ou can rule out the influence of the product engine runtime and the used content by restricting access to the product engine (using BAdI /PM0/ABP\_AUTH\_BADI ).
##  Caution
The product engine should always be located in the inner security zone.
The product engine does not save any in-force business data (stateless). It calculates and returns new application data from the application data supplied by Policy Management. Therefore, the product engine does not change the in-force business data directly. This situation, along with the journal management and history management functions provided by Policy Management, ensures to a large extent that the application data cannot be corrupted by the product engine.
## 13.13.4.2.4  SAP Statutory Reporting for Insurance
## 13.13.4.2.4.1  Deletion of Personal Data in FS-SR
## Use
The Statutory Reporting (FS-SR) might process data (personal data) that is subject to the data protection laws applicable in specific countries. The business partners in the statutory reports can only be legal entities (in German: juristische Personen), not natural persons. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data in the applications providing the data, for example, in Loans Management (FS-CML). For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection . In FS-SR, business partner data can only be deleted manually, using deletion reports.
## Relevant Application Objects and Available Deletion Functionality
| Application Object           | Detailed Description                         | Provided Deletion Functionality                |
|------------------------------|----------------------------------------------|------------------------------------------------|
| Ledger Data Table            | For more information, see SAP Note 2304306 . | • Transaction ISSR_NB2 • Transaction ISSR_MIG5 |
| Stored List                  |                                              | Transaction ISSR_OUT_ALV                       |
| Business Partner Change List |                                              | Transaction ISSR_DEL_CNS_GPCH                  |
## 13.13.5  Public Services
## 13.13.5.1  Defense &amp; Security
## 13.13.5.1.1  Defense &amp; Security
## 13.13.5.1.1.1  Roles and Authorization
This chapter describes the use of roles and authorizations in the industry solution SAP S/4HANA Defense &amp; Security. Defense &amp; Security uses the standard authorization concepts provided by SAP S/4HANA.
SAP delivers standard roles covering the most frequent business transactions. You can use these roles as a template for your own roles. In Defense &amp; Security, PFCG delta roles are used to access content in the
application. To complete the end-user role, these roles must be used along with other roles delivered by SAP . Example roles are included in the table below. These roles are designed to support your Defense &amp; Security business processes.
## 13.13.5.1.1.1.1  Roles
The frontend and backend roles that are delivered by Defense &amp; Security are shown below. You can use these roles as templates for your own roles.
## Defense Frontend Roles
| Role Name                 | Role Description                                  |
|---------------------------|---------------------------------------------------|
| SAP_BR_ORG_PLANNER        | Organizational Planner - Force Element            |
| SAP_BR_CAP_PLANNER        | Organizational Planner - Capabilities             |
| SAP_BR_ FEMAINT_PLANNER   | Maintenance Planner - Force Element               |
| SAP_BR_FEMAT_PLANNER      | Material Planner - Authorized Materials           |
| SAP_BR_MD_AUTHMAT         | Master Data Specialist - Authorized Material Data |
| SAP_BR_ORG_PLANNER_PERS   | Organizational Planner - Personnel                |
| SAP_BR_MAINT_TECH_OFFICER | Technical Officer - Armed Forces                  |
## Reused Roles
| Role Name                      | Role Description                     | Comment                                                                      |
|--------------------------------|--------------------------------------|------------------------------------------------------------------------------|
| SAP_BR_PRODMASTER_SPECIAL- IST | Master Data Specialist -Product Data | This role can be useful for the mate- rial planner.                          |
| SAP_BR_PROJECTMANAGER          | Project Manager                      | This role is necessary when using EPPMproject integration in Capabil- ities. |
## 13.13.5.1.1.1.2.1  Default Authorization Value Settings
The product master configuration of the default authorization values is shown below. This is mainly required to conform to industry-specific requirements and to enable the S/4 HANA Defense &amp; Security-specific authorization objects to apply to the product master app.
The default value for the authorization object DFS\_FE\_SNT for MD\_C\_PRODUCT\_MAINTAIN is yes, without any other values.
The default value for the authorization object DFS\_STRAUT for both MD\_C\_PRODUCT\_MAINTAIN\_SRV and MD\_PRODUCT\_OP\_SRV is yes, without any other values.
## 13.13.5.1.1.1.3  Defense Cross-Topics
On the basis of customer feedback, Defense &amp; Security has introduced an additional authorization function, which is described in the following.
## 13.13.5.1.1.1.3.1  Sensitivity
Defense &amp; Security provides a Sensitivity field, which customers can use to assign a specific sensitivity value to force elements. This can for example be used to define special force units. As a result, this field can then be used to prevent certain users accessing these units.
To categorize the sensitivity of a unit, the classification needs to be assigned.
|                 |                 | Global Field Name for   | Global Field Name for   |                  |
|-----------------|-----------------|-------------------------|-------------------------|------------------|
| View Name       | Table Name      | CDS view                | Domain                  | Text Table       |
| DFS_FE_SENSTV_V | DFS_FE_SENSTVTY | FrcElmntOrgSenstv- Key  | DFS_SENSITIV- ITY_TEXT  | DFS_FE_SENSTVT_T |
Some of the sample values are shown below:
|   MANDT |   SENSITIVITY_KEY | SENSITIVITY_TEXT   |
|---------|-------------------|--------------------|
|     903 |                01 | Very High          |
|     903 |                02 | High               |
|     903 |                03 | Medium             |
|     903 |                04 | Low                |
As a new feature, the sensitivity field has been integrated in the Classification section of force elements, FMPOs, capabilities, and capability statements. It has been enabled for multiple values, meaning that a single object can have several different sensitivity values. A user only needs to be granted authorization to access the object protected by the sensitivity for one of these values. The sensitivity value can also be inherited automatically from force elements to all other force elements at lower levels of the organizational hierarchy when the usage type of the sensitivity value is set to 'F' ( Defense &amp; Security Organizational Flexibility Security Define Sensitivity Levels ) in Customizing.
## 13.13.5.1.1.1.3.2  Structural Authorization
The SAP S/4HANA programming model supports the creation of Fiori-based apps using core data services (CDS) for data modeling and access, the OData protocol for service exposure, and the business object processing framework for transactional processing. Since CDS is a core mechanism for data retrieval from the backend, the relevant data control language (DCL) is required to restrict data according to authorizations for each user.
The picture below shows how structural authorizations are used in Defense &amp; Security in conjunction with the S/4 programming model.
In addition to force elements, all assignments that are assigned to a force element are also enabled for structural authorization. This means that if the user does not have authority for a force element, the assignments are also not visible (for example in other apps).
Users require change authority for force elements to change an assignment if the structural authorization is active.
In the case of force element to force element assignments (such as sup, sup by, maint, maint by), the user requires the authority for both the source and the target force elements to be able to edit them.
An FMPO is also enabled for the structural authorization if an assignment from the FMPO to the force element exists. If the user does not have authority for the force element, the FMPO CRUD app does not display this FMPO. The user requires change authority for the assigned force element to be able to change the FMPO.
The same applies to the product.
<!-- image -->
The existing configuration and artefacts, such as the structural profiles, transactions, such as OOSP/OOSB and other current report programs, such as RHAUTH01 are completely reused and integrated with the CDS views and DCLs to achieve the structural authorization.
The steps below are performed to achieve structural authorization:
1. Profiles for structural authorizations are created in the OOSP transaction. You must specify the details of the planning version, object ID, object type, evaluation path, status vector and processing type required.
2. These profiles created are assigned to users in the OOSB transaction with a validity start date and end date as shown in the screenshot below that contains example values.
3. The Exclude flag is now observed when executing the program (step 3). All force elements are deleted from the structural authorization table.
3. Execute the program DFS\_FE\_STRUC\_AUTHZN manually if any changes are made in the OOSB or OOSP transaction. This displays the authorized objects IDs assigned to each user.
<!-- image -->
<!-- image -->
With the 2020 release, the structural authorization can also be applied to non-force element objects. The position, flexible material planning object (FMPO) and product master are currently supported.
## 13.13.5.1.1.1.3.3  Context-Based Structural Authorization
Context-based structural authorization is based on the structural authorization concept. For more information about the structural authorization concept, see Structural Authorization [page 880]. Users and force elements can be assigned to respective profiles, but access is only granted if there is a match. If a user wants to perform different types of activities (such as display, edit, delete) on different force elements, they require context-based structural authorization. It is modeled using the personnel planning with the context procedure used in Human Resources.
## V\_DFS\_FE\_PDCON
This view is used to activate context-based structural authorization for Defense &amp; Security. You must select the indicator for it in transaction SM30. You must also enable the dummy authorization object DFS\_FE\_CON.
For more information about the product, see SAP Note 3081577