orkungedik/SAP-basis-dataset huggingface dataset:
## 13.5.3.3.8  Security for Additional Applications
You can only (import or) export data to Microsoft Project if you have the required authorizations, see Access Control Lists - Import and Export . The protection of this downloaded data is not part of the Project Management security model. When the user saves the project to his or her hard drive, the system does not perform an authorization check if somebody else opens the project again in Microsoft Project.
## 13.5.3.3.9  Other Security-Relevant Information
## Import from Microsoft Excel
You can import projects from a Microsoft Excel file to Project Management. This enables you to transfer mass data in a quick and easy manner.
If you want to restrict the import function, you have to make sure that only allowed users receive authorization for transaction DPR\_DX\_PROJECT and report DPR\_DX\_PROJECT .
Moreover, you can import financial and/or capacity data from a Microsoft Excel file to financial and capacity planning in Portfolio Management. To use this function, you require an ERP system, an appropriate client, user, and password. This import is only allowed if the required authorization has been granted.
## 13.5.4  Integrated Product Development for Discrete Industries
## 13.5.4.1  Classification Reuse UI Component
## 13.5.4.1.1.1  Data Privacy
The Classification Reuse UI Component must not process any sensitive personal data that is subject to the data protection laws applicable in specific countries as described in SAP Note 1825544 .
## Data Archiving and Deletion
Classification and characteristic data is dependent on the business object of the embedding application. You can only archive or delete classification and characteristic data with the business object of the embedding application, once the business object reaches its end of purpose. The embedding application is responsible for applying data protection and privacy rules.
## Characteristics Containing Sensitive Personal Data
Characteristics are not intended for storing any sensitive personal data.
## 13.5.4.2  Advanced Variant Configuration
## 13.5.4.2.1.1  Data Privacy
The Advanced Variant Configuration UI must not process any sensitive personal data that is subject to the data protection laws applicable in specific countries as described in SAP Note 1825544 .
## Data Archiving and Deletion
Characteristic data is dependent on the business object of the embedding application. You can only archive or delete characteristic data with the business object of the embedding application, once the business object reaches its end of purpose. The embedding application is responsible for applying data protection and privacy rules.
## Characteristics Containing Sensitive Personal Data
Characteristics are not intended for storing any sensitive personal data.
## 13.5.4.3  Logging Changes
Personal data is subject to frequent changes. Therefore, for revision purposes or as a result of legal regulations, it may be necessary to track the changes that have been made to this data. When these changes are logged,
you should be able to check which employee made which changes, the date and time, the previous value, and the current value.
It is also possible to analyze errors in this way.
## See Also
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Services for Application Developers into the search bar, press Enter , open the search result with that title, and navigate to Change Documents .
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Security Aspects for Lifecycle Management into the search bar, press Enter , open the search result with that title, and navigate to Auditing and Logging .
- See 2125662 for more information about superfluous data change logging defined for database tables.
## 13.5.4.3.1  Change Documents in Classification
## Setting Up Change Documents for Classification
You can set up change documents for classification data by setting the Change Docs indicator for a class type in Customizing under Cross-Application Components Classification System Classes Maintain Object Types and Class Types .
You can only set change documents if multiple objects are allowed to be classified in classes of the selected class type. When you first create a class type, you can set this parameter in Customizing manually. Once a class type has classified objects, you can only set this indicator by running report program RCCLUKA2, and you can only delete this indicator by running report program RMCLINOB.
## More Information
- For more information on classification change documents, see 65124 .
- See 2125662 for more information about superfluous data change logging defined for database tables.
## 13.5.4.4  Bill of Material
## Standard Roles
| Role                | Description                                                                                       |
|---------------------|---------------------------------------------------------------------------------------------------|
| SAP_BR_BOM_ENGINEER | You need this role to use the Maintain Bill Of Material and Material where used list inBOMs apps. |
## Standard Authorization Objects
| Authorization Objects   | Description                                       |
|-------------------------|---------------------------------------------------|
| C_STUE_WRK              | Authorization for CS BOMPlant (Plant Assignments) |
| C_STUE_BER              | Authorization for CS BOMAuthorizations            |
## 13.5.5  Product Lifecycle Management
## 13.5.5.1  Maintenance, Repair, and Overhaul
## 13.5.5.1.1  Authorizations (Specification 2000)
Specification 2000 (IS-ADEC-SPC) uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used:
| Authorization Object   | Description                    |
|------------------------|--------------------------------|
| C_ADSPCIP              | Spec2000: Authorization object |
## 13.5.5.1.2  Deletion of Personal Data (Specification 2000)
## Use
Specification 2000 (IS-ADEC-SPC) might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
<!-- image -->
## Relevant Application Objects and Available Deletion Functionality
| Application                      | Provided Deletion Functionality                                             |
|----------------------------------|-----------------------------------------------------------------------------|
| Specification 2000 (IS-ADEC-SPC) | Archiving Object ADS2KIP_AR ILM Object ADS2KIP_AR Report AD_SCIP_ILM_DEL_01 |
## Relevant Application Objects and Available EoP/WUC functionality
| Application                      | Implemented Solution (EoP or WUC)   | Further Information        |
|----------------------------------|-------------------------------------|----------------------------|
| Specification 2000 (IS-ADEC-SPC) | EoP                                 | Checks tables EDP21, EDP13 |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
## 13.5.5.1.3  Deletion of Personal Data (Spare Parts Stock Calculation)
## Use
Spare Parts Stock Calculation (IS-ADEC-SPSC) might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                                  | Provided Deletion Functionality   |
|----------------------------------------------|-----------------------------------|
| Spare Parts Stock Calculation (IS-ADEC-SPSC) | Report                            |
|                                              | AD_SPSC_ILM_DEL_01                |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
## 13.5.5.1.4  Authorizations (Manufacturer Part Number)
Manufacturer Part Number (MPN) uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used:
| Authorization Object   | Description                                               |
|------------------------|-----------------------------------------------------------|
| M_PIC_RIC              | Authorization for MPNRestricted Interchangeability        |
| ADPIC_RIC              | Authorization object for MPNRestricted Interchangeability |
| M_PIC_EXCH             | Authorization for material exchange                       |
## 13.5.5.1.5  Deletion of Personal Data (MPN)
## Use
Manufacturer Part Number (IS-ADEC-MPN) might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available EoP/WUC functionality
| Application                             | Implemented Solution (EoP or WUC)   | Further Information     |
|-----------------------------------------|-------------------------------------|-------------------------|
| Manufacturer Part Number (IS-ADEC- MPN) | EoP                                 | Checks table MARA-MFRPN |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
## 13.5.5.1.6  Deletion of Personal Data (Sharing of Spare Parts and Customer Stock)
Sharing of Spare Parts and Customer Stock (IS-AD-SSP) might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                | Provided Deletion Functionality                                                      |
|----------------------------|--------------------------------------------------------------------------------------|
| Customer Stock (IS-AD-SSP) | Destruction Object MM_STO_SOBES_DEST ILM Object MM_STO_SOBES Report MM_STO_SOBES_DES |
## Relevant Application Objects and Available EoP/WUC functionality
| Application                | Implemented Solution (EoP or WUC)   | Further Information                             |
|----------------------------|-------------------------------------|-------------------------------------------------|
| Customer Stock (IS-AD-SSP) | EoP check                           | Checks tables MSCD_MD, MCSS_MD, MSCD_MD,MSCS_MD |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
## 13.5.5.1.7  Deletion of Personal Data (Subcontracting for MRO Processes)
Subcontracting for MRO Processes ((IS-AD-SUC) might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                                                  | Provided Deletion Functionality                                                      |
|--------------------------------------------------------------|--------------------------------------------------------------------------------------|
| Subcontracting for MROProcesses (IS-AD-SUC) - Special Stocks | Destruction Object MM_STO_SOBES_DEST ILM Object MM_STO_SOBES Report MM_STO_SOBES_DES |
## Relevant Application Objects and Available EoP/WUC functionality
| Application                                                  | Implemented Solution (EoP or WUC)   | Further Information                                                |
|--------------------------------------------------------------|-------------------------------------|--------------------------------------------------------------------|
| Subcontracting for MROProcesses (IS- AD-SUC) - Special Stock | EoP check                           | Checks tables MSFS_MD, MSFD_MD, MSIS_MD, MSID_MD, MSRS_MD, MSRD_MD |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
## 13.5.5.2  Attachment Service
## Roles and Authorizations
For information on roles and authorizations for Attachment Service, goto https:/ /help.sap.com/viewer/ p/SAP\_S4HANA\_ON-PREMISE, and see under Product Assistance Enterprise Business Applications R&amp;D / Engineering Product Lifecycle Management (PLM) Attachment Service Technical Information for Consuming Application Roles and Authorizations .
## 13.5.5.2.1  Deletion of Personal Data
## End of Purpose Check
Consuming applications must adapt the BAdI BADI\_CV\_ODATA\_ATTACHMENTS\_AUTH to block the display or change of attachments once a business object has reached its end of purpose. The corresponding method in the BAdI is CHECK\_AUTHORIZATION .
Moreover, to block access to the attachments with the Document Info Record (DIR) in Document Management, you must implement the BAdI DOCUMENT\_FILES01 , and its method BEFORE\_START\_APPL .
## 13.5.5.2.3  User Consent
The attachment service does not enforce user consent. The consuming application is responsible for enforcing user consent if required.
## 13.5.5.3  Document Management
For security-related information about Document Management, see the topics in this section.
## 13.5.5.3.2  Data Protection
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different countries. This section describes the specific features and functions that Document Management (DMS) provides to support compliance with the relevant legal requirements and data privacy.
This section and any other sections in this Security Guide do not give any advice on whether these features and functions are the best method to support company, industry, regional or country-specific requirements. Furthermore, this guide does not give any advice or recommendations regarding additional features that would be required in an environment; decisions related to data protection must be made on a case-by-case basis and under consideration of the given system landscape and the applicable legal requirements.
##  Note
In most cases, compliance with data privacy laws is not a product feature. SAP software supports data privacy by providing security features and specific data-protection-relevant functions such as functions for the simplified blocking and deletion of personal data. SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken from any given legal source
## 13.5.5.3.2.1  Configuration of Data Protection Functions
Certain central functions that support data protection compliance are grouped under customizing for CrossApplication Components under Data Protection.
Additional industry-specific, scenario-specific, or application-specific configurations might be required.
You can define or block access control to DIR data based on the personal data in the customizing Maintain DIR Access Based on Personal Data under Cross-Application Components Document Management Control Data . For more information, see the customizing documentation in the system.
## 13.5.5.3.2.2  Deletion of Personal Data
Document Management or CA-DMS might process data (personal data) that is subject to the data protection laws applicable in specific countries as described in the SAP Note 1825544 .
The SAP Information Lifecycle Management (ILM) component supports the entire software lifecycle including the storage, retention, blocking, and deletion of data. Document Management or CA-DMS uses SAP ILM to support the deletion of personal data as described in the following sections.
## 13.5.5.3.2.2.1  End of Purpose (EoP) Check
The End of Purpose check for a DIR (DRAW) object cannot be ascertained as there is no specific flag, field, or status that indicates this.
## 13.5.5.3.2.2.2  Handling Blocked Personal Data for a Blocked Business Partner in Document Management Application
Let's consider a customer or vendor master that is directly associated with a document info record (DIR), and that object has been blocked. In this case, Document Management application provides a customizing, based on which the access to a DIR and sections of a DIR can be decided by the users.
You can define or block access control to DIR data based on the personal data in the customizing Maintain DIR Access Based on Personal Data under Cross-Application Components Document Management Control Data . For more information, see the customizing documentation in the system. The authorization object DMS\_DPP must be assigned to your role to perform this customizing. For more information, see Authorizations [page 590].
- Blocking of DIR: When a user tries to display a DIR that has a reference to a blocked customer or vendor, the application checks the customizing, and decides whether the DIR should be opened in display or change mode. If it is allowed, then the relevant rules for file access and classification apply. The navigation to the respective applications via double-click operation is also blocked. The user cannot attach (object link) the blocked customer or vendor object as the search help of these applications do not display the blocked objects.
- Blocking of Files and Classification: When a DIR is accessed, the files and classification details are not displayed if the associated customer or vendor is blocked.
The Document Management BAPI's (Business Application Programming Interface) that are used to create, change, and display DIRs are adjusted to follow the customizing with respect to personal data. ALE scenarios are also considered here.
## 13.5.5.3.2.2.3  Handling Deleted Business Partner
For a DIR, it is not possible to determine the End of Business, and the End of Purpose of the associated customer or vendor. Hence, it is possible that the customer or vendor associated with a DIR can be blocked and later destroyed.
If the linked customer or vendor object is destroyed, the DMS application provides a deletion report that displays the usage of destroyed customers or vendors in the corresponding document info records. However, until the deletion report is run, the link is still displayed. For more information about the deletion report, see Deletion Report [page 594].
## 13.5.5.3.2.2.4  Deletion Report
The linked customer or vendor object may reach retention time and can be archived and destroyed. In this scenario, the document would still retain the link to this object, and while displaying this link, the link is masked.
The deletion report DMS\_BLOCKED\_REF\_DELETE accepts document type and object type as mandatory inputs, and lists the documents that are associated with destroyed customer or vendor object. The user can choose the documents from the list, and delete the links for the same.
A new authorization object DMS\_DPP is created to control the access to this report (same as the one for controlling access to customizing data).
## 13.5.5.3.2.2.5  Archiving or Destroying Business Data
The archiving and destruction of business data in Document Management takes place in accordance with the retention rules, and the option chosen while running the reports DVSARCH1 and DVSARCH2 respectively.
## 13.5.5.3.2.2.6  ILM Archiving for a DIR Including Files, Classification, and Object Links
Before archiving data, you must define the residence time, and retention periods in SAP Information Lifecycle Management (ILM).
You must decide whether data deletion is required for data stored in archive files or data stored in the database, also depending on the type of deletion functionality available.
You must do the following:
- Run transaction IRMPOL to maintain the required residence and retention policies for the document info record (ILM object: CV\_DVS ).
- For information about setting up the archiving object CV\_DVS, go to https:/ /help.sap.com/ s4hana\_op\_2021, enter Archiving Document Info Records (CA-DMS) into the search bar, press Enter , and open the search result with that title.
For information about how to configure blocking and deletion for Document Management, CA-DMS, refer to the customizing documentation for the following SPRO activity: Cross-Application Components Data Protection Authorization Management Business Partner: Blocking and Deletion .
## 13.5.5.3.3  Read Access Logging
In Read Access Logging (RAL), you can configure which read-access information to log, and under which conditions.
In the following configurations, fields are logged in combination with additional fields, in the following business contexts:
| Configuration          | Logged for Service / Appli- cation                | Fields Logged                                 | Business Context                                                  |
|------------------------|---------------------------------------------------|-----------------------------------------------|-------------------------------------------------------------------|
| IDEA_DMS_PCD1_KPRO.xml | Any access to attachment or files stored via KPro | User Timestamp Access Type PHIO Class PHIO ID | The KPro configuration logs any user accessing a DMSat- tachment. |
For more information about Read Access Logging, go to https:/ /help.sap.com/viewer/p/ SAP\_S4HANA\_CLOUD, and see under Product Assistance Generic Information General Functions for the Key User Read Access Logging .
## 13.5.6  Product Development for Discrete Industries
## 13.6 Sales
## Standard Authorization Objects
The following table explains where you can find the standard authorization objects available for line of business Sales and related functionality (transaction SU21 ):
| Class   | Description                                                                                                                                                                                      |
|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SD      | Sales and Distribution                                                                                                                                                                           |
| LE_T    | Logistics Execution - Transportation                                                                                                                                                             |
| LE_V    | Logistics Execution - Shipping                                                                                                                                                                   |
| WG      | For Global Trade Management (GTM): Retailing • Trading Contract: Authorization for Organizational Data ( W_WBHK_ORG ) • Trading Contract: Authorization for Trading Contract Type ( W_WBHK_TCT ) |
## 13.6.1  Sales Force Support
## 13.6.1.3  Sales Documents
Sales Force Support provides a user interface to view and edit sales documents (such as sales orders or sales order quotations).
For this scenario, you require one of the following PFCG roles:
| Role                | Description        |
|---------------------|--------------------|
| SAP_S4C_UIU_SLS_PRO | Sales Professional |
| SAP_S4C_UIU_SLS_EMP | Sales Employee     |
## 13.6.1.4  Deletion of Personal Data in Sales Force Support
## Use
Business objects in Sales Force Support might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Service Basic Functions Information Lifecycle Management .
## Relevant Business Objects and Available Deletion Functionality
| Business Objects   | Provided Deletion Functionality   |
|--------------------|-----------------------------------|
| Activity           | Archiving object CRM_ACT_ON       |
| Lead               | Archiving object CRM_LEAD         |
| Opportunity        | Archiving object CRM_OPPT         |
## Relevant Business Objects and Available EoP Functionality
| Business Objects                   | Implemented Solution (EoP or WUC)   | Further Information                                                                                                             |
|------------------------------------|-------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|
| Pre-Sales and Sales ( CRM-S4-SLS ) | EoP check                           | This EoP check includes business in the areas of the following: • Sales • Service • Billing • Pricing • Procurement • Logistics |
## More Information
- For more information about data protection, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Service Basic Functions Data Protection .
- For more information about archiving business objects that belong to completed business processes, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/ s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Service Basic Functions Data Archiving .
## 13.6.2  Order and Contract Management
## 13.6.2.2  Global Trade Management
## 13.6.2.3  Read Access Logging
## Use
In Read Access Logging (RAL), you can configure which read-access information to log and under which conditions.
SAP delivers sample configurations for applications.
Sales logs data in order to track who has accessed sensitive customer data in sales order requests. You can find the configurations as described in the Read Access Logging [page 33] chapter.
In the following configurations, fields are logged in combination with additional fields, in the following business contexts:
| Configuration                                                                                             | Fields Logged                                                                                                                                                                                                                             | Business Context                                                                                                 |
|-----------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------|
| Sales / SD-SLS / Create Sales Orders - Automatic Extraction App (Service ID: C_SlsOrdReqFrmExtSource_SD ) | • Sold-to party ( SOLDTOPARTY ) • Sold-to party VAT registration number ( EXTRACTEDSOLDTOPTYTAXREGNU MBER ) • Sold-to party tax number ( EXTRACTEDSOLDTOPARTYTAXNUM BER ) • Sold-to party bank account ( EXTRACTEDSOLDTOPTYBANKACCO UNT ) | This configuration allows you to log the access to fields in the Create Sales Orders - Automatic Extraction app. |
## 13.7 Service
## 13.7.2  Internet Communication Framework Security (ICF) in Service
Get information on the services required to use apps in Service.
## WebClient UI Apps
To use apps based on the WebClient UI framework, you need to activate the services listed below.
If your deployment has WEBCUIF applications embedded in SAP Fiori Launchpad ( FLP Integrated Mode ), activate the following services:
/default\_host/sap/bc/bsp/sap/bsp\_dlc\_frcmp
/default\_host/sap/bc/bsp/sap/bsp\_wd\_base
/default\_host/sap/bc/bsp/sap/bspwd\_basics
/default\_host/sap/bc/bsp/sap/crm\_ui\_frame
/default\_host/sap/bc/bsp/sap/crm\_ui\_start
/default\_host/sap/bc/bsp/sap/crm\_ui\_sysmsg
/default\_host/sap/bc/bsp/sap/crm\_thtmlb\_util /default\_host/sap/bc/bsp/sap/thtmlb\_styles /default\_host/sap/bc/bsp/sap/thtmlb\_scripts /default\_host/sap/bc/bsp/sap/wcf\_jquery /default\_host/sap/webcuif/uif\_callback /default\_host/sap/webcuif/uif\_export\_tab If your deployment has standalone WEBCUIF applications, in addition to the services for the embedded release, activate the following services: /default\_host/sap/bc/bsp/sap/crm\_bsp\_frame /default\_host/sap/bc/bsp/sap/gsbirp /default\_host/sap/bc/bsp/sap/crmcmp\_hdr /default\_host/sap/bc/bsp/sap/crmcmp\_hdr\_std /default\_host/sap/bc/bsp/sap/uicmp\_ltx /default\_host/sap/bc/bsp/sap/ic\_base /default\_host/sap/webcuif/uif\_feed /default\_host/sap/webcuif/uif\_flex\_data /default\_host/sap/webcuif/wcf\_fct
##  Note
For more information, see SAP Note 2825458 .
## Apps in In-House Repair
```
To use apps in In-House Repair, activate the following services: UI_MANAGEINHREPAIRS UI_PERFORMPRECHECKS UI_PROCREPAIRQTANS UI_PLANREPAIRS UI_PERFORMREPAIRS
```
UI\_PREPAREFORBILLG
## Activating the Services
Only activate those services that you need for the applications running in your system. You can activate these services under HTTP Service Hierarchy Maintenance (transaction SICF ).
If your firewalls use URL filtering, you need to adjust your firewall settings accordingly.
For general information, see ICF and Session Security [page 21] section in this security guide.
## 13.7.3  Read Access Logging
## Use
In Read Access Logging (RAL), you can configure which read-access information to log and under which conditions.
SAP delivers sample configurations for applications.
Service logs data in order to track who has accessed the bank details related to the SEPA mandate that is assigned to the payer in service transactions. You can find the configurations as described in the Read Access Logging [page 33] chapter.
In the following configurations, fields are logged in combination with additional fields, in the following business contexts:
| Channel   | Configuration                                                | Fields Logged                                                                     | Business Context                                                                                                                    |
|-----------|--------------------------------------------------------------|-----------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| CRMWebUI  | SEPA / CRM-S4-SRV / Bank Data in Value Help for SEPA Mandate | SWIFT/BIC ( SND_BIC ) IBAN ( SND_IBAN ) ID of Sender ( SND_ID )                   | This configuration allows you to log the access to fields for bank data in the value help for SEPA mandate in service transactions. |
| Dynpro    | SEPA / CRM-S4-SRV / Bank Data in SEPA Mandate Details        | Mandate Ref. ( MNDID ) Customer ( KUNNR ) SWIFT/BIC ( SND_BIC ) IBAN ( SND_IBAN ) | This configuration allows you to log the access to fields that display bank data for SEPA mandate.                                  |
## 13.7.4  Deletion of Personal Data in Service
## Use
Business objects in Service might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Cross Components Data Protection .
## Relevant Business Objects and Available Deletion Functionality
| Business Objects     | Provided Deletion Functionality   |
|----------------------|-----------------------------------|
| Service Contract     | Archiving object CRM_SRCONT       |
| Service Confirmation | Archiving object CRM_SRVCON       |
| Service Order        | Archiving object CRM_SERORD       |
| Knowledge Article    | Archiving object CRM_KA           |
| Service Request      | Archiving object CRM_INCDNT       |
| In-House Repair      | Archiving object CRMS4_REPA       |
## Relevant Business Objects and Available End of Purpose (EoP) Functionality
| Business Objects       | Implemented Solution (EoP or WUC)   | Further Information                                                                                                               |
|------------------------|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| Service ( CRM-S4-SRV ) | EoP check                           | This EoP check includes business ob- jects in the following areas: • Sales • Service • Billing • Pricing • Procurement • Delivery |
For more information, see the product assistance for SAP S/4HANA on SAP Help Portal at https:/ / help.sap.com/s4hana\_op\_2021 under Enterprise Business Applications Service Data Management in Service Blocking, Unblocking, and Deletion of Personal Data in Service Business Partner End of Purpose (EoP) Check in Service .
## More Information
- For more information about data protection, see the product assistance for SAP S/4HANA on SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Enterprise Business Applications Service Data Management in Service .
- For more information about archiving business objects that belong to completed business processes, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/
s4hana\_op\_2021 under Enterprise Business Applications Service Data Management in Service Data Archiving in Service .
## 13.7.6  Master Data
## 13.7.6.1  Business Partners (Accounts and Contacts)
## Why Is Security Necessary?
Security within account, contact, and employee (business partner) processing in the master data area is necessary because these areas access sensitive customer and personal data, such as private address data, payment cards, bank details, and so on. This data is accessed from one central point that is integrated into the different systems. Therefore, you should restrict access to this data.
## Authorizations
Account, contact, and employee (business partner) processing uses the authorization technique provided by the ABAP platform. Therefore, the recommendations and guidelines for authorizations as described in the ABAP Platform Security Guide also apply to the application.
The authorization concept is based on the assignment of authorizations to users based on roles. For role administration, use the profile generator (transaction PFCG ). For more information, see the Role Administration [page 13] section in this security guide.
## Additional Authorization Checks
Enhanced authorization check capabilities related to the secured processing of sensitive data of accounts, contacts, and employees in SAP S/4HANA Service are provided by the Authorization Checks ( BADI\_CRM\_BP\_UIU\_AUTHORITY ) Business Add-In (BAdI). For more information, see the BAdI system documentation.
## Network and Communication Security
The network topology for master data is based on the topology used by the ABAP platform. The security guidelines and recommendations described in the ABAP Platform Security Guide and the corresponding component-specific sections of this security guide also apply to master data in SAP S/4HANA Service.
For more information, see the Network and Communication Security [page 19] section in this security guide.
## Data Protection and Privacy
For more information about data management for business partners, see the product assistance for SAP S/4HANA on SAP Help Portal at http:/ /help.sap.com/s4hana under Enterprise Business Applications Service Business Partners Functions .
## Data Storage Security
The data is stored in database tables owned by SAP S/4HANA and the ABAP platform. Depending on the user, rights such as read, write, change, and delete are required. There is no need for you to adopt any other dedicated measures for data storage security.
## 13.7.6.2  Organizational Management
## Why Is Security Necessary?
Organizational Management in SAP S/4HANA Service is a flexible tool to display your company's task-related, functional organizational structure. When using the service solution, you can simply display the organizational units that are relevant for your processes.
Organizational Management uses the ABAP platform.
## Network and Communication Security
## Communication Channel Security
For more information about communication channel security, see Network and Communication Security [page 19]. The available communication paths, protocols used, and type of data transferred are listed in the following table:
| Communication Path                        | Protocol Used                                   | Type of Data Transferred   | Data Requiring Special Pro- tection                 |
|-------------------------------------------|-------------------------------------------------|----------------------------|-----------------------------------------------------|
| Frontend client using SAP GUI for Windows | Dynamic Information and Ac- tion Gateway (DIAG) | All application data       | Passwords, all sensitive data such as customer data |
| Frontend client using a web browser       | HTTP/HTTPS                                      | All application data       | Passwords, all sensitive data such as customer data |
## Communication Destinations
The following communication destinations can be reached using the communication paths listed in the above section Communication Channel Security :
| Destination   | Delivered?   | Type                                          | User, Authorizations   | Description   |
|---------------|--------------|-----------------------------------------------|------------------------|---------------|
| ABAP platform | Yes          | Dynamic Information and Action Gateway (DIAG) | User, password         | N/A           |
## Data Storage Security
Data is stored in database tables of ABAP platform. Depending on the user role, the appropriate rights - read, write, change, and delete - are required. No additional data storage security is required.
## 13.7.6.3  Knowledge Articles (Knowledge Management)
## Why Is Security Necessary?
Security is necessary to protect internal documents from misuse due to external access or access from other departments. If documents are not protected, sensitive data may become public knowledge and harm your enterprise.
Documents may also contain viruses, which can damage your entire network if they are not discovered and eliminated in time.
## User Administration and Authentication
## Authorizations
In SAP S/4HANA Service, user authorizations for a business object to which documents are assigned are copied to the documents. For example, if a user only has read authorization for an application, then he or she only has read authorization for the associated documents.
You can also implement an authorization check at document level. In Customizing for Service , choose Basic Functions Content Management Business Add-Ins (BAdIs) BAdI: Authorization Check on Document Level .
<!-- image -->
## Deletion of Personal Data
For more information about the available deletion functionality, see Deletion of Personal Data in Service [page 611].
## 13.7.7  Service Processes
Service order processing in SAP S/4HANA Service enables you to process service requests, service order quotations, service orders, and service confirmations.
## Security Aspects of Data Flow and Processes
The following figure shows the data flow in service order processing.
<!-- image -->
The following table shows the security aspects to be considered for the process step and what mechanism applies:
|   Step | Description                                                | Security Measure                                                                                                                        |
|--------|------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|
|      1 | User creates order in SAP S/4HANA Service                  | • User type: Dialog user with assign- ment to business role SERVICEPRO and corresponding PFCG role • Communication protocol HTTP/ HTTPS |
|      2 | User saves data in SAP S/4HANA Serv- ice                   | Not applicable                                                                                                                          |
|      3 | System creates or updates sales order in SAP S/4HANA Sales | Not applicable                                                                                                                          |
## Network and Communication Security
The network topology for master data is based on the topology used by the ABAP platform. The security guidelines and recommendations described in the ABAP Platform Security Guide and the corresponding component-specific sections of this security guide also apply to all service processes.
## Communication Channel Security
The table below shows the communication channels used by Service processes, the protocol used for the connection, and the type of data transferred.
| Communication Path                                              | Protocol Used   | Type of Data Transferred   | Data Requiring Special Pro- tection                                                              |
|-----------------------------------------------------------------|-----------------|----------------------------|--------------------------------------------------------------------------------------------------|
| Frontend client using SAP GUI for Windows to SAP Fiori frontend | HTTP/HTTPS      | URLs                       | Passwords, all sensitive data such as credit card informa- tion, customer data, and con- ditions |
| Frontend client using a web browser                             | HTTP/HTTPS      | All application data       | Passwords, all sensitive data such as credit card informa- tion, customer data, and con- ditions |
## 13.7.7.1  Service Order Management
Using the core service functions, you can process service order quotations, service orders, and service confirmations.
## Role Administration
Depending on your requirements, you use either the Service Professional or the Service Employee business role for the core service transactions.
| Business Role   | PFCG Role           | Description          |
|-----------------|---------------------|----------------------|
| S4C_SRV_PRO     | SAP_S4C_UIU_SRV_PRO | Service Professional |
| S4C_SRV_EMP     | SAP_S4C_UIU_SRV_EMP | Service Employee     |
For more information on business roles in Service, see Role Administration in Service [page 608] in this security guide.
## Deletion of Personal Data
For more information about the available deletion functionality, see the section Deletion of Personal Data in Service [page 611] in this security guide.
## 13.7.7.2  Survey Tool
## Why Is Security Necessary?
Checklist
| Feature                  | Check                                                      | How to Check                                           |
|--------------------------|------------------------------------------------------------|--------------------------------------------------------|
| View or maintain surveys | Does the PFCG role allow access to the survey application? | Role assignment                                        |
| View or maintain surveys | Leading object checks for read or edit rights for surveys  | Leading object (for example, an oppor- tunity or lead) |
## Authorization Objects
The following authorization object is used for survey processing:
| Authorization Object   | Authorization Field   |
|------------------------|-----------------------|
| CRM_SVY                | ACTVT                 |
Access checks are done based on PFCG roles. Currently, surveys are enabled in the Interaction Center for the Service Professional role.
## Network and Communication Security
## Communication Channel Security
The table below shows the communication channels used by Survey Tools, the protocol used for the connection, and the type of data transferred.
| Communication Path   | Protocol Used   | Type of Data Transferred   |
|----------------------|-----------------|----------------------------|
| Internet             | TCP/IP(SSL)     | General data               |
## Communication Destinations
The following communication destinations can be reached using the communication paths listed in the Communication Channel Security section above:
| Destination   | Delivered?   | Type                                          | User, Authorizations   | Description   |
|---------------|--------------|-----------------------------------------------|------------------------|---------------|
| ABAP platform | Yes          | Dynamic Information and Action Gateway (DIAG) | User, password         | N/A           |
## Data Storage Security
Data is stored in database tables of the ABAP platform. Depending on the user, no special data storage security measures are required. Surveys are a dependent application, so the leading application storage security applies to survey read or edit rights.