orkungedik/SAP-basis-dataset huggingface dataset:
## 13.5.2.1.2.1  Communication Destinations
The table below shows an overview of the communication destinations used by Product Compliance for Discrete Industries . For more generic information, see in corresponding chapter in the Introduction section.
| Destination   | Delivered   | Type   | Description                                                                |
|---------------|-------------|--------|----------------------------------------------------------------------------|
| <PMsystem>    | No          | RFC    | Connection to plant maintenance system                                     |
| <BuPa system> | No          | RFC    | Connection to business partner system                                      |
| <AC system>   | No          | RFC    | Connection to accounting system                                            |
| <EHS system>  | No          | RFC    | Connection to SAP Product Safety and Stewardship as part of SAP ERP system |
##  Note
The user in the remote AC system needs to have all authorizations as proposed by the respective EHS user roles.
For SAP EHS Management as part of SAP ERP , Product Compliance for Discrete Industries does not provide any authorizations.
For detailed information about communication destinations, see Customizing for Environment, Health, and Safety under Foundation for EHS Integration Specify Destinations for Integration .
## 13.5.2.1.3  ICF Security in Product Safety and Stewardship
To use an app in Product Safety and Stewardship, you have to activate the internet communication framework (ICF) service that is needed for this app.
For general information, see ICF Security [page 21] in the Introduction section.
## Product Compliance for Discrete Industries
To use Product Compliance for Discrete Industries apps, proceed as follows:
- In your back-end system, open transaction SICF . Under /default\_host/sap/bc/webdynpro/sap/ , activate the following Web Dynpro services:
- that start with EHFND
- that start with EHPRC
- POWL
- IBO\_WDA\_INBOX
- WDR\_CHIP\_PAGE
## 13.5.2.1.4  Data Storage Security
## Using Logical Path and File Names to Protect Access
In Product Compliance for Discrete Industries , several applications save data in files in the file system. The International Material Data System (IMDS) uses the file system to store downloaded files temporarily, before they are imported. Additionally, it is possible for users to upload files to the application server manually prior to further processing. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime, and, if access is requested to a directory that does not match a stored mapping, an error occurs.
The following lists show the logical file names and paths used by Product Compliance for Discrete Industries and for which programs these file names and paths apply:
## Logical File Names Used
The following logical file names have been created in order to enable the validation of physical file names:
- EHPRC\_IMPORT\_DIR
- EHPRC\_ERROR\_DIR
- EHPRC\_ARCHIVE\_DIR
For more information, see the Customizing activity Set Up Directory Structure for IMDS .
## Logical Path Names Used
The logical file names listed above all use the logical file path EHPRC\_HOME\_PATH.
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). T o find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log.
For more information about data storage security, see the respective chapter in the ABAP Platform Security Guide.
## 13.5.2.1.5  Data Protection and Privacy
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different countries. This section describes the specific features and functions that Product Safety and Stewardship for Discrete Industries provides to support compliance with the relevant legal requirements and data privacy.
This section and any other sections in this Security Guide do not give any advice on whether these features and functions are the best method to support company, industry, regional or country-specific requirements. Furthermore, this guide does not give any advice or recommendations with regard to additional features that would be required in a particular environment; decisions related to data protection must be made on a case-bycase basis and under consideration of the given system landscape and the applicable legal requirements.
##  Note
In the majority of cases, compliance with data privacy laws is not a product feature. SAP software supports data privacy by providing security features and specific data-protection-relevant functions such as functions for the simplified blocking and deletion of personal data. SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken from any given legal source.
## 13.5.2.1.5.1  Deletion of Personal Data
Product Safety and Stewardship for Discrete Industries might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management ( SAP ILM ) to control the blocking and deletion of personal data in Product Safety and Stewardship for Discrete Industries .
## More Information
- For general information about the blocking and deletion of data for customers, vendors and business partners, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/ s4hana\_op\_2021 under Product Assistance Cross Components Data Protection .
- For more information about the deletion of customer and vendor master data, see the Security Guide for SAP ERP on the SAP Help Portal at http:/ /help.sap.com/erp under SAP ERP Central Component Security Guide Data Protection Deletion of Personal Data .
- For more information about simplified blocking and deletion of customer and vendor master data, see Customizing under Logistics - General Business Partner Deletion of Customer and Vendor Master Data .
- For more information about simplified blocking and deletion of central business partner master data, see Customizing for Cross-Application Components under Data Protection Blocking and Unblocking Business Partner .
## 13.5.2.1.5.1.1  Deletion of Personal Data for Product Compliance for Discrete Industries
SAP Information Lifecycle Management ( SAP ILM ) supports the entire software lifecycle including the storage, retention, blocking, and deletion of data.
Product Compliance for Discrete Industries uses SAP ILM to support the deletion of personal data as described in the following sections.
## Relevant Application Objects and Available Deletion Functionality
The following table shows the application objects and the appropriate deletion functionality that is provided in Product Compliance for the Discrete Industries .
| Application Objects                      | Provided Deletion Functionality   |
|------------------------------------------|-----------------------------------|
| Worklists for compliance assessment      | Archiving object EHPRC_WLCA       |
| Worklists for regulatory changes         | Archiving object EHPRC_WLRC       |
| Intenational Material Data Sheets (IMDS) | Archiving object EHPRC_MDS        |
| Compliance data records                  | Archiving object EHPRC_COD        |
| Campaigns                                | Archiving object EHPRC_CMP        |
| E-mail assignments                       | Archiving object EHPRC_PSA        |
| Assessments and BOMtransfers             | Archiving object EHPRC_PBB        |
## Deletion Report and Job Dependencies
Product Compliance provides the deletion report R\_EHPRC\_DPP\_CLEANUP which verifies if any CDOs that are marked as end of business are used in any composition or supplier listing. If this is the case, it changes the lifecycle status to Active which prevents the CDO from being archived.
The report needs to be run as a periodic job. Schedule report R\_EHPRC\_DPP\_CLEANUP with option CDOs check Out of Business , every time before you run the preprocessing and the write program.
For more information about application objects and deletion functionality, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications R&amp;D / Engineering Product Safety and Stewardship Product Compliance (EHS-MGM-PRC) Data Protection in Product Compliance .
## 13.5.2.1.5.1.2  Logging Changes
Personal data is subject to frequent changes. Therefore, for revision purposes or as a result of legal regulations, it may be necessary to track the changes that have been made to this data. When these changes are logged, you should be able to check which employee made which changes, the date and time, the previous value, and the current value.
It is also possible to analyze errors in this way.
## See Also
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Services for Application Developers into the search bar, press Enter , open the search result with that title, and navigate to Change Documents .
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Security Aspects for Lifecycle Management into the search bar, press Enter , open the search result with that title, and navigate to Auditing and Logging .
- See 2125662 for more information about superfluous data change logging defined for database tables.
## 13.5.2.1.6  Virus Scanning
The interactive forms of Product Compliance for Discrete Industries can contain JavaScript. Therefore, JavaScript must be enabled in Adobe Acrobat Reader. In addition, e-mails with PDF attachments that contain JavaScript must not be filtered out in the e-mail inbound and outbound process.
For more generic information see Virus Scanning [page 24] in the Introduction section.
## 13.5.2.2  Product Safety and Stewardship for Process Industries
This section contains information that is valid for:
- Basic Data and Tools
- Product Safety
- Global Label Management
- Dangerous Goods Management
## 13.5.2.2.1  Technical System Landscape
## Product Safety
Expert is a registering Remote Function Call (RFC) server that reads and writes specification data through RFC from the SAP system.
Windows Wordprocessor Integration ( WWI ) is a registering RFC server that generates and prints reports.
Report shipping can be determined centrally in the product safety system, or product safety document data can be distributed by ALE/IDOC to logistics systems. These logistics systems use their own WWI generation servers ( WWI servers) to print documents.
## Dangerous Goods Management
If you use separate logistics systems, dangerous goods data can be transferred to logistics systems by ALE/ IDOC.
## Global Label Management
The technical system landscape for Global Label Management consists of the following elements:
- WWI is a registering RFC server. It can contain its own database that is used as a document cache and data cache.
- Option 1: Label printing is possible with a printer that is connected to a local PC. WWI servers are hosted on a central WWI server farm. Printing is executed by the SAP spool system or a printer that is connected to a local PC.
- Option 2: Label printing is executed through print requests. WWI servers are decentralized. Therefore, the data of the print requests is sent directly to the printer, or the print requests are printed through the SAP spool system.
- Option 3: Label printing is possible via an extraordinary, distributed approach for product safety. In this case, plants host their own SAP systems. Document data is maintained centrally and distributed by ALE. Printing is determined directly or through the SAP spool system.
## 13.5.2.2.2  User Administration and Authentication
Product Safety and Stewardship for Process Industries uses the administration and authentication mechanisms provided with the SAPNet Weaver platform.
For more generic information see User Administration and Authentication [page 10] in the Introduction section.
## 13.5.2.2.3  Network and Communication Security
Your network infrastructure is important for protecting your system. Therefore, your network must support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system level and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the backend system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit known bugs and security holes in network services on the server machines.
The network topology for Product Safety and Stewardship is based on the topology used by the ABAP Platform. Therefore, the security guidelines and recommendations described in the ABAP Platform Security Guide also
apply here. Details that specifically apply to Product Safety and Stewardship are described in the following sections:
- Communication Channel Security [page 523]
This topic describes the communication paths and protocols.
- Network Security [page 524]
This topic describes the recommended network topology. It shows the appropriate network segments for the various client and server components and where to use firewalls for access protection. It also includes a list of the ports required.
- Communication Destinations [page 524]
This topic describes the information needed for the various communication paths, for example, which users are used for which communications.
For more information, see the following sections in the ABAP Platform Security Guide :
- Network and Communication Security
- Security Guides for Connectivity and Interoperability Technologies
## 13.5.2.2.3.2  Network Security
## Ports
WWI generation servers (WWI servers) and Expert servers use Remote Function Call (RFC).
For more information, see https:/ /help.sap.com/viewer/ports.
## 13.5.2.2.4  Application-Specific Virus Scan Profile (ABAP)
SAP provides an interface for virus scanners to prevent manipulated or malicious files from damaging the system. To manage the interface and to find out which file types are checked or blocked, use the virus scan profiles. Some applications rely on default profiles, while others rely on application-specific profiles.
To use a virus scanner with the SAP system, you must activate and set up the virus scan interface. During this process, you also set up the default behavior. Here, SAP also provides the following default profiles:
| Application                                             | Profile                      | Allowed MIME Types   | Blocked MIME Types   |
|---------------------------------------------------------|------------------------------|----------------------|----------------------|
| Product Safety and Steward- ship for Process Industries | /CBUI/WWI_REPORT_GEN         | *                    | -                    |
| Global Label Management                                 | /CBGLMP_API/ WWI_GET_CONTENT | *                    | -                    |
When the application-specific virus scan profile is activated, this profile has the following impact:
- Documents generated by the WWI generation server ( WWI server) are scanned for viruses
- Documents imported into Product Safety and Stewardship for Process Industries are scanned for viruses
## 13.5.2.2.6  Data Protection and Privacy
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different countries. This section describes the specific features and functions that Product Safety and Stewardship for Process Industries provides to support compliance with the relevant legal requirements and data privacy.
This section and any other sections in this Security Guide do not give any advice on whether these features and functions are the best method to support company, industry, regional or country-specific requirements. Furthermore, this guide does not give any advice or recommendations with regard to additional features that would be required in a particular environment; decisions related to data protection must be made on a case-bycase basis and under consideration of the given system landscape and the applicable legal requirements.
##  Note
In the majority of cases, compliance with data privacy laws is not a product feature. SAP software supports data privacy by providing security features and specific data-protection-relevant functions such as functions for the simplified blocking and deletion of personal data. SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken from any given legal source.
## 13.5.2.2.6.1  Deletion of Personal Data
Product Safety and Stewardship for Process Industries might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management ( SAP ILM ) to control the blocking and deletion of personal data in Product Safety and Stewardship for Process Industries .
## More Information
- For general information about the blocking and deletion of data for customers, vendors and business partners, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/ s4hana\_op\_2021 under Product Assistance Cross Components Data Protection .
- For more information about the deletion of customer and vendor master data, see the Security Guide for SAP ERP on the SAP Help Portal at http:/ /help.sap.com/erp under SAP ERP Central Component Security Guide Data Protection Deletion of Personal Data .
- For more information about simplified blocking and deletion of customer and vendor master data, see Customizing under Logistics - General Business Partner Deletion of Customer and Vendor Master Data .
- For more information about simplified blocking and deletion of central business partner master data, see Customizing for Cross-Application Components under Data Protection Blocking and Unblocking Business Partner .
- For more information about simplified blocking and deletion of customer and vendor master data in other applications, see Customizing of the application under Data Protection .
- For more information about settings for authorization management, see Customizing of the application under Data Protection Authorization Management .
## 13.5.2.2.6.1.3  Deletion of Personal Data for Report Management
SAP Information Lifecycle Management ( SAP ILM ) supports the entire software lifecycle including the storage, retention, blocking, and deletion of data.
Report Management uses SAP ILM to support the deletion of personal data as described in the following.
## Process Flow: Data Blocking and Data Destruction
1. Before blocking and deleting data in Report Management , define the residence times and retention periods in SAP Information Lifecycle Management in transaction ILM Policies ( IRMPOL ) for the EHS\_PS\_REPMAN\_DESTRUCTION ILM object.
2. To block data that match the residence times in Report Management , run program RC1\_REPHIS\_BLOCK to block the report shipping orders of a certain status.
3. For more information, see the documentation of this program in the ABAP: Program Execution (transaction SA38 ).
3. To destroy data, proceed as described in the documentation of the data destruction object in Report Management .
See section Relevant Application Objects and Available Deletion Functionality for the relavant data destruction objects in Report Management .
## Relevant Application Objects and Available Deletion Functionality
The following table shows the application object and the appropriate deletion functionality that is provided for Report Management .
| Application       | Provided Deletion Functionality                                                                                                                          |
|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Report Management | Data destruction object to destroy inbound-reports with the status Historical or Archived that are no longer relevant once the retention period expires. |
For more information about application objects and deletion functionality, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications R&amp;D / Engineering Product Safety and Stewardship Product Safety (EHS-SAF) Data Destruction in Product Safety .
## 13.5.2.2.6.1.4  Deletion of Personal Data for Global Label Management
SAP Information Lifecycle Management ( SAP ILM ) supports the entire software lifecycle including the storage, retention, blocking, and deletion of data.
Global Label Management uses SAP ILM to support the deletion of personal data as described in the following.
The data destruction for Global Label Management is integrated in the FI\_ACCRECV ( customer master data ) ILM object of SAP ERP .
You use BAdI method IF\_EX\_FI\_ACCRECV\_WRITE~DELETE of BAdI implementation EHS\_LABELING\_DPP to delete customer-specific labels in table CCGLT\_CLBL ( EHS: Customer-Specific Labels ) that are related to the customer master and the vendor master to be deleted.
Additionally, you have to set up program Reorganize Print Requests and Change Documents ( RCBGL\_PRINTREQUEST\_REORG ) to delete the relevant entries in tables CCGLT\_PRTREQ\_HDR ( EHS: Print Request Header Table ) and CCGLT\_PRTREQ\_PAR ( EHS: Print Request Parameters ).
## More Information
SAP Note 2327810 (Simplified data deletion based on SAP ILM in Global Label Management)
For more information about the deletion of customer and vendor master data, see the Security Guide for SAP ERP on the SAP Help Portal at http:/ /help.sap.com/erp under SAP ERP Central Component Security Guide Data Protection Deletion of Personal Data .
## 13.5.2.2.6.2  Logging Changes
Personal data is subject to frequent changes. Therefore, for revision purposes or as a result of legal regulations, it may be necessary to track the changes that have been made to this data. When these changes are logged,
you should be able to check which employee made which changes, the date and time, the previous value, and the current value.
It is also possible to analyze errors in this way.
## See Also
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Services for Application Developers into the search bar, press Enter , open the search result with that title, and navigate to Change Documents .
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Security Aspects for Lifecycle Management into the search bar, press Enter , open the search result with that title, and navigate to Auditing and Logging .
- See 2125662 for more information about superfluous data change logging defined for database tables.
## 13.5.2.2.6.2.1  Change Logging in Substance Volume Tracking
## Setting Up Change Logs for Substance Volume Tracking
Substance Volume Tracking processes personal data of only representatives for external and internal business partners. If any changes are made regarding these internal and external business partners, the system logs the following information on personal data:
- The user who has changed data
- Date and time of the change
- Change type
- Transaction of the data change
- Data origin
- Internal and external only representatives whose data have been changed
- Internal and external business partners whose data have been changed
You can set up the change logging for external and internal business partners in transaction Maintain Profile Parameters ( RZ10 ) as follows:
1. Enter the name of the start profile or the system profile to be edited and select Extended Maintenance under Edit Profile .
2. Change the profile by entering the following::
- Parameter Name : rec/client
- Parameter Value : Enter the client of the system in which you want to log data.
3. Save and activate the profile.
4. Restart the application server.
The system now logs all changes of internal and external business partners, and internal and external only representatives that are made in table CCRCT\_OR ( Material Business Partner Only Representative Assignment ) of Substance Volume Tracking ).
All changes are logged in table DBTABLOG .
## Displaying Change Logs in Substance Volume Tracking
You can call up the change logs in transaction Table History ( SCU3 ).
For more information see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ / help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications R&amp;D / Engineering Product Safety and Stewardship Product Safety (EHS-SAF) Data Protection in Product Safety Logging Changes in Substance Volume Tracking
## More Information
- For more information on logging changes in Substance Volume Tracking , see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications R&amp;D / Engineering Product Safety and Stewardship Product Safety (EHS-SAF) Data Protection in Product Safety
- See 2125662 for more information about superfluous data change logging defined for database tables.
## 13.5.2.2.7  Dispensable Functions with Impacts on Security
You can compile and display system information for Windows Wordprocessor Integration (WWI) as follows:
- You can display system information in the WWI Monitor (transaction CG5Z ): In the menu, choose Utilities Test Server
- In WWI.INI, under [ Global ], enter as DisableWwiServerInfo the value 1 . This prevents external access to the WWI system information (through the WWI Server Monitor , for example). The default value is 0 .
## 13.5.2.2.8  Security for Additional Applications
## Windows Authorization for Windows Wordprocessor Integration
Windows Wordprocessor Integration (WWI) requires a Windows user account that is used to run the WWI generation server services. This is because many printer settings and settings for Microsoft Word are userspecific.
As an abbreviation, the user account is called WWI user .
- Create a new Windows user. This user is used to execute the WWI generation server (WWI server). The user can be a local user or a domain user. We recommend creating a local user, for example, WWI-USER . Assign this user to the Main users group or the Users group. Use a password that does not expire.
- In Microsoft Windows Vista, in Microsoft Windows Server 2008 and higher releases, assign the WWI user to the administrators group.
- If the user is a domain user, ensure that the profile of the user is local .
- Check the security settings for the user that is used to execute the WWI server:
- The user must have the Log on as a service authorization. In Microsoft Windows XP, Microsoft Windows Server 2003 and higher releases, also set this authorization for users of the administrators group. You can find this authorization in the Control Panel under Administrative Tools Local Security Policy . Navigate to Local Policies User Rights Assignment . Here, you assign the user privileges to the guideline Log on as a service .
- Check the DCOM start authorization and access authorization for Microsoft Word using the DCOMCNFG.EXE configuration program. For more information, see the SAP Note 580607 .
- Ensure that the user has write (change) authorization for the WWI root directory. We recommend using a local directory. The WWI work directory is configured in the Specify Generation Servers Customizing activity.
- Make sure that the Microsoft Windows TEMP directory exists. The TEMP directory is configured in Microsoft Windows under Control Panel System Advanced Environment Variables . There, check the user variables and system variables TMP and TEMP.
- Ensure that the user has write (change) authorization for the Microsoft Windows TEMP directory.
For further information, see SAP Note 580586 .
## Windows Authorization for Expert
The Expert server service is run as a local system account.
## Windows Authorization for Administration Management Server
The Administration Management Server service is run as a local system account.
## 13.5.3  Enterprise Portfolio and Project Management
## 13.5.3.1  Project System
## 13.5.3.2  Commercial Project Management
## 13.5.3.2.2  Data Storage Security
In Commercial Project Management, the header data of the financial plan is stored in the database tables of Project Cost and Revenue Planning.
- Data is saved in the database tables of Project Cost and Revenue Planning when the user explicitly chooses the Save pushbutton on the financial planning screen.
- The planning data is stored in the BW InfoCube and can be transferred to the S4CORE database tables by the user.
- Data is saved in the BW InfoCube when the user explicitly chooses the Save Data pushbutton in the Analysis Office workbook.
- Data is saved in S4CORE database tables when the user explicitly chooses the Transfer Data pushbutton on the financial planning screen.
## 13.5.3.2.3  Data Archiving
## 13.5.3.2.3.1  Archiving Commercial Projects
You can use Archiving Object for Commercial Projects ( /CPD/PWS\_M ) to archive commercial projects that are no longer needed. Archiving allows you to reduce the load on your database.
Structure
## Tables
Tables for Commercial Projects
| Table            | Description                           |
|------------------|---------------------------------------|
| /CPD/S_MP_HDR_K  | Commercial Project Header             |
| /CPD/D_MP_HDR_S  | Commercial Project Header Short Text  |
| /CPD/D_MP_ITEM   | Commercial Project Structure Elements |
| /CPD/D_MP_MEMBER | Project Member                        |
| /CPD/D_MP_REP_AT | Reporting Attribute Node              |
| /CPD/D_MP_RESP   | Responsibility Node                   |
| /CPD/D_MP_STATUS | Status Header                         |
| /CPD/D_MP_ST_ARV | Table for Status Area Version         |
| /CPD/D_MP_ST_HRA | Status Header Area                    |
| /CPD/D_MP_ST_VHR | Status Versions                       |
| Table            | Description         |
|------------------|---------------------|
| /CPD/D_MP_TEAM   | Team                |
| /CPD/D_MP_TEAM_M | Team Member Subnode |
| /CPD/D_MP_TEAM_R | Team Role Subnodes  |
## Programs
The following programs are available for /CPD/PWS\_M :
- Preprocessing: /CPD/PWS\_ARCH\_MP\_PRE This program makes the following checks for commercial projects: If both these conditions are satisfied, the program sets the archiving status of the commercial project to
Archiving in Process (02).
- Write: /CPD/PWS\_ARCH\_MP\_WRITE
This program checks if an object has the status Archiving in Process (02). If the status is 02, the program archives the object to the archive file.
- Delete: /CPD/PWS\_ARCH\_MP\_DELETE
This program verifies archived files against the data in the database, and deletes all objects in the database that have been successfully archived.
Information Lifecycle Management (ILM)
Information Lifecycle Management (ILM) allows you to define rules for storing archived business data, set legal holds on stored data, and destroy the data in adherence to legal requirements.
The ILM object CPD\_PWS\_M is available for commercial projects and this ILM object allows you to model retention rules based on the following fields:
- Condition Fields
- Archiving Status
- Commercial Project Type
- Organization
- Time Reference Fields
- End Date
You can use the transaction IRMPOL to define policies and rules for ILM.
Prerequisites
The prerequisites for Retention Management are:
- You have activated the business function ILM
- You have assigned the following objects to an audit area:
- CPD\_PWS\_M
More Information
To change the residence time, you can make settings in Customizing for Cross-Application Components under Processes and Tools for Enterprise Applications Reusable Objects and Functions for BOPF Environment Archiving Adapter Maintain BO-Specific Residence Periods .
## 13.5.3.2.3.3  Archiving Issues and Change Requests
You can use Archiving Object for Issues and Change Requests ( /PICM/BO\_I ) to archive issues and change requests that are no longer needed. Archiving allows you to reduce the load on your database.
Structure
## Tables
Tables for Issues and Change Requests
Table
Description
| /BOBF/D_ATF_DO   | Document node of attachment folder   |
|------------------|--------------------------------------|
| Table            | Description                                          |
|------------------|------------------------------------------------------|
| /BOBF/D_ATF_RT   | Root nodes of attachment folder                      |
| /BOBF/D_TXCCON   | Text content                                         |
| /BOBF/D_TXCROOT  | Root node of text collection                         |
| /BOBF/D_TXCTXT   | Text                                                 |
| /IAM/D_I_ATT     | Attachment                                           |
| /IAM/D_I_DATE    | Date                                                 |
| /IAM/D_I_DESC    | Description node                                     |
| /IAM/D_I_DESC_TX | Language-dependent description text node             |
| /IAM/D_I_OBJ_REF | Issue reference node                                 |
| /IAM/D_I_OREF_DT | Language-dependent, reference, description text node |
| /IAM/D_I_PARTY   | Party node                                           |
| /IAM/D_I_QTY     | Quantity                                             |
| /IAM/D_I_ROOT    | Root node                                            |
## Programs
The following programs are available for /PICM/BO\_I :
- Preprocessing: /PICM/ARCH\_ISSUE\_CR\_ROOT\_PRE This program checks if an object is ready for archiving by verifying the following conditions:
- The adherence to the specified residence time
- The availability of activities for the object
If the object is ready, this program sets the status as Archiving in Process (02) in the database. After the preprocessing program has run, the objects marked for archiving are no longer made available on the UI.
- Write: /PICM/ARCH\_ISSUE\_CR\_ROOT\_WRITE This program checks if an object has the status Archiving in Process (02). If the status is 02, the program archives the object to the archive file.
- Delete: /PICM/ARCH\_ISSUE\_CR\_ROOT\_DEL This program verifies archived files against the data in the database; and deletes all objects in the database
that have been successfully archived..
## More Information
To change the residence time, you can make settings in Customizing for Cross-Application Components under
Processes and Tools for Enterprise Applications
Reusable Objects and Functions for BOPF Environment
Archiving Adapter Maintain BO-Specific Residence Periods .
## 13.5.3.2.3.4  Archiving Activities
You can use Archiving Object for Activities ( /PICM/BO\_A ) to archive activities that are no longer needed. Archiving allows you to reduce the load on your database.
Structure
## Tables
Tables for Activities
| Table              | Description                              |
|--------------------|------------------------------------------|
| /BOBF/D_ATF_DO     | Document node of attachment folder       |
| /BOBF/D_ATF_RT     | Root nodes of attachment folder          |
| /BOBF/D_TXCCON     | Text content                             |
| /BOBF/D_TXCROOT    | Root node of text collection             |
| /BOBF/D_TXCTXT     | Text                                     |
| /IAM/D_ACT_ATT     | Attachment                               |
| /IAM/D_ACT_DATE    | Date                                     |
| /IAM/D_ACT_DESC    | Description node                         |
| /IAM/D_ACT_DTXT    | Language-dependent description text node |
| /IAM/D_ACT_FOA     | Follow-up action                         |
| /IAM/D_ACT_FOA_P   | Follow-up action parameter               |
| /IAM/D_ACT_OBJ_RF  | Object reference                         |
| /IAM/D_ACT_OREF_DT | Language-dependent description texts     |
| /IAM/D_ACT_PARTY   | Party                                    |
| /IAM/D_ACT_QTY     | Activity quantity                        |
## Programs
The following programs are available for /PICM/BO\_A :
· Preprocessing: /PICM/ARCH\_ACTIVITY\_ROOT\_PPROC This program checks if an object is ready for archiving by verifying the adherence to the specified residence time. If the object is ready, this program sets the status as Archiving in Process (02) in the database. After the preprocessing program has run, the objects marked for archiving are no longer made available on the UI.
- Write: /PICM/ARCH\_ACTIVITY\_ROOT\_WRITE This program checks if an object has the status Archiving in Process (02). If the status is 02, the program archives the object to the archive file.
- Delete: /PICM/ARCH\_ACTIVITY\_ROOT\_DEL This program verifies archived files against the data in the database; and deletes all objects in the database that have been successfully archived.
More Information
To change the residence time, you can make settings in Customizing for Cross-Application Components under
- Processes and Tools for Enterprise Applications Reusable Objects and Functions for BOPF Environment
Archiving Adapter Maintain BO-Specific Residence Periods .
## 13.5.3.2.5  Protection of Data Stored in BW InfoCube
Project Cost and Revenue Planning uses embedded BW technology and the BW InfoCube stores personal data of customers and employees.
The customer InfoObject ( /CPD/CUSTOMER ) is an attribute of the commercial project InfoObject ( /CPD/MPID ); and the commercial project is an attribute of the financial plan InfoObject ( /CPD/FPOID ). The master data of the customer InfoObject is updated from the transactional screens of Commercial Project Management. To address the exclusion of customers' personal data, which has been marked for End of Purpose (EoP), the HANA calculation view CV\_CUSTOMER (package: sap.cpms4h.pfp ) performs a join of the commercial project header and the customer master data table ( KNA1 ) to ensure that masking is done using the CVP\_XBLCK flag.
The master data of employees is used in the SAP BW InfoObject ( /CPD/FPERID ), from SAP HCM for SAP S/4HANA, using the HANA calculation view CV\_EMPLOYEE . The business partner End of Purpose (EoP) is fetched from the CDS view I\_EMPLOYEE to address the exclusion of employees' personal data that has been marked for End of Purpose. The system uses the BW InfoObject /CPD/EMP\_ACTV to handle inactive employees so that they are not available with the financial planning application of Commercial Project Management.
You can use the report /CPD/PFP\_PERSONAL\_PROJECT\_LIST to display to logged-in users the business objects (commercial projects and financial plans) where their individual personal data is used. The report allows employees to check usage of their own personal data across commercial projects.
For more information of the archiving concept and the objects that cover the erasure requirements of personal data, see the relevant chapters in Data Archiving.
##  Note
You must configure the archiving concept and objects according to regional laws.
For more information, see Customizing for Commercial Project Management:
- Master Data Define End of Purpose for Personal Data
- Project Cost and Revenue Planning Information on Personal Data Protection
- Project Issue and Change Management Define End of Purpose for Personal Data
## 13.5.3.2.6  Logging of Changes
Commercial Project Management provides change logging to audit changes to key fields in the projects:
In Project Workspace, the system logs changes to certain information in master projects. Each log contains information such as the fields that were changed, the old and new values of the field, the user who changed the information, the type of change, and the time and date when the change was made.
You can now view change logs for the following:
- Master project header
- Contact person
- Risk
- Checklist activity
You can also control change logging using the Business Add-In BAdI: Control of Change Log Output. For more information, see Customizing for SAP Commercial Project Management --&gt; Project Workspace --&gt; Business Add-Ins.
Project Cost and Revenue Planning allows you to view the changes made in a financial plan. You can choose the Document History pushbutton, on the Financial Plan screen, to view this change log.
You can also control change logging using the Business Add-In BAdI: Control of Change Log Output. For more information, see Customizing for SAP Commercial Project Management --&gt; Project Cost and Revenue Planning --&gt; Business Add-Ins.
Project Issue and Change Management allows you to view the changes made in an issue or change request. You can choose the Document History pushbutton, on the Issue or Change Request screens, to view this change log.
You can also control change logging using the Business Add-In BAdI: Control of Change Log Output. For more information, see Customizing for SAP Commercial Project Management --&gt; Project Issue and Change Management --&gt; Business Add-Ins.
## 13.5.3.2.7  Security-Relevant Logging and Tracing
The Project Cost and Revenue Planning application of Commercial Project Management uses the tracing functions of SAP BusinessObjects Analysis for Microsoft Office (AO) to trace actions performed in the planning workbook (AO). You can also activate a trace file for Project Cost and Reveue Planning using the Activate Tracing button on the Financial Planning ribbon. Details of the items are recorded in the trace file ( CACPDFP\_TRACE\_LOG.log ). Note that the file does not record user-specific personal information such as user name or IP address.
For information about tracing related to Analysis Office, see https:/ /help.sap.com/viewer/p/ SAP\_BUSINESSOBJECTS\_ANALYSIS\_OFFICE Installation, Configuration, Security and Administration Administrator Guide .
## 13.5.3.2.8  Other Security-Relevant Information
Before you use the digitally-signed SAP BusinessObjects Analysis for Microsoft Office (AO) workbooks delivered by Commercial Project Management, you must follow these steps:
##  Caution
These settings are valid if you want to use the workbooks in a secure way by only enabling digitally-signed macros. However, if you use custom workbooks or make any changes and save it back to the standard, you must enable all macros.
1. Launch Microsoft Excel
1. Go to File Options Trust Center Settings Macro Settings
2. Choose Disable all macros except digitally signed macros
3. Mark the Trust access to the VBA project object model checkbox
2. Launch the digitally-signed workbook and implement the following steps to add the certificate as a trusted publisher:
1. A security warning is show in File Info Enable Control
2. Seclect Advanced Options
3. In the next dialog box, select Trust all documents from this publisher
##  Note
Adding the certificate is a one-time activity
3. Follow these steps to change the default system in the workbook:
1. Go to File Commercial Project Settings
2. In the dialog box, choose Platform
3. Choose Replace System
4. Choose your relevant system in the Replace by System column
5. Save the workbook (with the correct standard workbook name) in the relevant system
## 13.5.3.3  SAP Portfolio and Project Management
## 13.5.3.3.3  Network Security
SAP supports the installation of SAP Portfolio and Project Management within the intranet (for internal collaboration only).
## Installation Scenarios
Scenarios A and B can be used for SAP Portfolio and Project Management:
- Scenario A: No content server
- Scenario B: One hidden content server
Installation scenario B, with one hidden content server, is the installation scenario with the highest level of security.
## Scenario A: No Content Server
In scenario A, the complete installation consists only of SAP Portfolio and Project Management server (AS ABAP).
The server is located in the intranet.
Scenario A: No Content Server
<!-- image -->
## Scenario B: One Hidden Content Server
In the second type of installation, one content server is added to the network environment.
For SAP Portfolio and Project Management, the AS ABAP and the content server are both located in the intranet.
Scenario B: One Hidden Content Server
<!-- image -->
## 13.5.3.3.4  Communication Destinations
For the default SAP Portfolio and Project Management scenarios, no RFC destination pointing to external systems is required. However, if you are using the Project Management application programming interfaces (APIs) via the SOAP wrapper, the APIs consist of RFC function modules.
SAP Portfolio and Project Management
- FI/CO integration / Accounting Integration
- Adobe Document Services (ADS)
- Object links to e.g. SAP R/3, SAP ERP
- HR integration
In the following areas, Portfolio Management RFCs are called from an external application:
- Project integration
The Project Management APIs are required for:
- Portfolio Management Integration
- If a user needs to use the APIs they must have the basic RFC authorization for the relevant API function modules. The SOAP wrapper adheres to the authorization rules that apply if the RFC module is called directly. The function group name for Project Management is CPR\_API .
To view the application-specific and basis authorization objects used in SAP Portfolio and Project Management, see Authorizations [page 561].
For more information about authorization objects and roles, go to https:/ /help.sap.com/s4hana\_op\_2021, enter AS ABAP Authorization Concept into the search bar, press Enter , and open the search result with that title.
## 13.5.3.3.5  Internet Communication Framework Security
You should only activate those services that are needed for the applications running in your system. For more information about the services that are needed for SAP Portfolio and Project Management, see the Activating Services section of the Configuration Guide for SAP Portfolio and Project Management.
Use the transaction SICF to activate these services.
If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Activating and Deactivating ICF Services into the search bar, press Enter , and open the search result with that title.
For more information about ICF security, go to https:/ /help.sap.com/s4hana\_op\_2021, enter RFC/ICF Security Guide into the search bar, press Enter , and open the search result with that title.
## 13.5.3.3.6  Data Storage Security
## Data Storage
##  Note
In the default setting for SAP Portfolio and Project Management, data is protected using the ACL concept already described in Authorizations [page 561]. A Web browser is required for both scenarios. However, no cookies are used to store data on the front end.
## Data Protection
In SAP Portfolio and Project Management, data is mainly stored on the Application Server ABAP (AS ABAP) database. An exception to this is when files are checked out for editing. In this case, files are stored locally on the user's hard drive and it is their responsibility to protect the files according to company security policy.
Depending on which installation scenario you have chosen for SAP Portfolio and Project Management, files might also be stored on content servers. For information about security measures to be taken in this case, see the Network Security chapter of this document.
For more information about data protection, see the Data Protection chapter of this document.