orkungedik/SAP-basis-dataset huggingface dataset:
## 13.13.1.1.1.1  Read Access Logging
Read Access Logging (RAL) is used to monitor and log read access to sensitive data. This data may be categorized as sensitive by law, by external company policy, or by internal company policy. These common questions might be of interest for an application that uses Read Access Logging:
- Who accessed the data of a given business entity, for example a bank account?
- Who accessed personal data, for example of a business partner?
- Which employee accessed personal information, for example religion?
- Which accounts or business partners were accessed by which users?
These questions can be answered using information about who accessed particular data within a specified time frame. Technically, this means that all remote API and UI info structures (that access the data) must be enabled for logging.
## Use
In Read Access Logging (RAL), you can configure which read-access information to log and under which conditions. SAP delivers sample configurations for applications. The application component scenario logs data in order to describe business processes. You can find the configurations as described in this chapter.
For the following configurations, fields are logged in combination with additional fields in the following business contexts:
| Configuration   | Fields Logged                  | Business Context                                                                                                                    |
|-----------------|--------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| /ACCGO/LDC_WC   | Driver ID, License, Vehicle ID | If any person accesses the informa- tion about these fields using transac- tion /ACCGO/LDC_WC either in Change Mode or Display Mode |
Read Access Logging is currently limited to the following channels, however:
- Remote Function Calls (sRFC, aRFC, tRFC, qRFC, bgFRC)
- Dynpro (dynpro fields, ALV Grid, ABAP List, F4)
- Web Dynpro
- Web services
- Gateway (for oData)
## 13.13.1.1.1.3  Change Log
Person-related data is subject to frequent changes. Therefore, for revision purposes or because of legal regulations, it may be necessary to be able to track the changes made. If these changes are logged, at any time you can check which employee made which change and when.
Change log has been enabled for the following fields in the Agricultural Contract Management process:
1. Driver ID
2. License Number
3. Vehicle ID
4. Customer
5. Vendor
You can execute program RSSCD200 to get the change information of these documents.
## 13.13.1.2  Retail and Fashion
## 13.13.1.2.1  Network and Communication Security
The following information is relevant for specific SAP S/4HANA Retail solutions. For general information about network and communication security in SAP S/4HANA, see Network and Communication Security [page 19].
## Communication Paths for SAP Forecasting and Replenishment
For information about the security of communication paths for integration with SAP Forecasting and Replenishment, see the Security Guide for SAP Forecasting and Replenishment.
## Other Communication Paths for SAP S/4HANA Retail
The following table shows the communication paths for all remaining system connections for SAP S/4HANA Retail solutions.
Communication Paths for SAP S/4HANA Retail
| Application                           | Communication Path                      | Protocol Used                               | Type of Data Transfer- red   | Data Requiring Spe- cial Protection   |
|---------------------------------------|-----------------------------------------|---------------------------------------------|------------------------------|---------------------------------------|
| Store physical inven- tory            | SAP S/4HANA - store system              | RFC (or other protocol that supports IDocs) | Application data             | -                                     |
| POS interface                         | SAP S/4HANA - POS system                | RFC (or other protocol that supports IDocs) | Application data             | Credit card informa- tion             |
|                                       | SAP S/4HANA - POS system                | SOAP                                        | Application data             | -                                     |
| Interface to space management systems | SAP S/4HANA - space optimization system | RFC                                         | Application data             | -                                     |
## 13.13.1.2.2  Authorizations in Retail
##  Note
For general information about the authorization concept used by SAP S/4HANA, see User Administration and Authentication [page 10].
SAP S/4HANA Retail uses the authorization concept provided by the ABAP platform. Therefore, the recommendations and guidelines for authorizations as described in the ABAP Platform Security Guide also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the AS ABAP and the User Management Engine's user administration console on the AS Java.
## Standard Roles
For information about the standards roles that are available for
- SAP S/4HANA Retail for merchandise management, see https:/ /help.sap.com/s4hana choose your version and go to Product Assistance Industries Consumer Industries Retail (Retail and Fashion) Retail for Merchandise Management .
- SAP S/4HANA for fashion and vertical business solutions, see https:/ /help.sap.com/s4hana choose your version and go to Product Assistance Industries Consumer Industries Retail (Retail and Fashion) Fashion and Vertical Business .
## Standard Authorization Objects
For information about the standard authorization objects that are used in
- SAP S/4HANA Retail for merchandise management, see https:/ /help.sap.com/s4hana choose your version and got to Product Assistance Industries Consumer Industries Retail (Retail and Fashion) Retail for Merchandise Management Marketing and Merchandising Master Data Management Authorization Objects for Merchandise Management .
- SAP S/4HANA for fashion and vertical business solutions, see https:/ /help.sap.com/s4hana choose your version and got to Product Assistance Industries Consumer Industries Retail (Retail and Fashion) Fashion and Vertical Business Brand Management and Merchandising Brand Management and Merchandising Marketing and Brand Data and Insights Authorization Objects for Fashion and Vertical Business .
## 13.13.1.3  Last Mile Distribution (LMD)
## 13.13.1.4  Prepayment Agreements
## 13.13.1.4.1  Information Retrieval
Personal data can be retrieved by creating models in the Information Retrieval Framework (IRF).
Data subjects have the right to get information regarding their personal data that is undergoing processing. The information retrieval feature supports you in complying with the relevant legal requirements for data protection by allowing you to search for and retrieve all personal data for a specified data subject. The search results are displayed in a comprehensive and structured list containing all personal data of the data subject specified, subdivided according to the purpose for which the data was collected and processed.
Follow the instructions below to set up your data model.
Apart from setting up a data model, you must also maintain the purposes relevant to your organization.
- To generate the data model for your ILM object, execute transaction DTINF\_ADJUST\_MODEL . In the ILM Object field, enter PPMG\_AGR and click Generate .
- To maintain the purpose relevant to your ILM object, execute transaction DTINF\_MAINTAIN\_PURP . Select Assign ILM Objects and from the Assign ILM Objects table, choose PPMG\_AGR .
- To trigger the automated retrieval of all personal data, execute transaction DTINF\_START\_COLL . Enter the Data Subject ID Type , Data Subject ID , Language and Purpose and click Execute .
- To display and download the search results of the data collection process, execute transaction DTINF\_PROC\_COLL .
## More Information
For more information about setting up and using the IRF, see https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Technology ABAP Platform Administrating the ABAP Platform Administration Concepts and Tools Solution Life Cycle Management Information Retrieval Framework (IRF) .
For more information about data protection, see https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Cross Components Data Protection .
## 13.13.2  Discrete Industries
## 13.13.2.1  Automotive
## 13.13.2.1.1  Vehicle processes for Wholesale and Retail
## 13.13.2.1.1.1  Authorizations
Vehicle Processes for Wholesale and Retail uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the Application Server ABAP Security Guide also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used.
| Authorization Object   | Description                                                                                                                                   |
|------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
| C_AUTO_VMS             | Vehicle Management System (VMS): Controls whether a user is allowed to execute VMSactions                                                     |
| C_AUTO_DPV             | Dealer Portal VMS: Controls whether a user is allowed to execute dealer portal functions, for example, create a sales order without a vehicle |
## 13.13.2.1.1.2  Deletion of Personal Data
## Use
The Vehicle Management System (VMS) might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                          | Provided Deletion Functionality             |
|--------------------------------------|---------------------------------------------|
| Vehicle Management System (IS-A-VMS) | Archiving Object VEHICLE ILM Object VEHICLE |
## Relevant Application Objects and Available EoP/WUC functionality
| Application                           | Implemented Solution (EoP or WUC)   | Further Information    |
|---------------------------------------|-------------------------------------|------------------------|
| Vehicle Management System (IS-A- VMS) | EoP                                 | Check table VLCVEHICLE |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
##  Note
Vehicle Management System delivers two business events, which are exposed along with the Vehicle Identification Number (VIN). The VIN can indirectly refer to a person if information such as purchase order or sales order is attached to it. This must be kept in mind to restrict unknown subscriptions to the event and to thereby avoid security issues.
## 13.13.3  Energy &amp; Natural Resources
## 13.13.3.1  Oil and Gas
## 13.13.3.1.1  Upstream Operations Management
## 13.13.3.1.1.3  Other Security-Relevant Information
The following table shows an overview of the data flow in UOM in a two system DMZ environment. Data access is separated from the presentation layer, which is running on the second machine. The UI is accessed using HTTP or HTTPs.
| Step                                                              | Description                                                                                                                    | Security Measure                                                                                          |
|-------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------|
| User Interface: FPM-based ABAP Web- Dynpro with Unified Rendering | Data requests, updates, and actions are triggered from the UI.                                                                 | ABAP WebDypro, unified rendering, ac- cess using HTTP or HTTPS                                            |
| PLMUI Framework                                                   | Infrastructure for communication be- tween GUIBBs/WebDynpro context and SPI connector                                          |                                                                                                           |
| SPI Connector (DMZ System)                                        | Acting like a proxy for the back end SPI connector.                                                                            | Metadata is read from back end only                                                                       |
| RFC                                                               | RFC based data transfer betweenDMZ system and ERP back end system; xstring based data transfer                                 | Protocol switch to RFC; Allowlist for ta- ble based data transfer; Sync with meta data model in connector |
| SPI Connector (Back End System)                                   | A standardized interface that is used to transfer data from the application serv- ice provider to the UI framework con- sumer. | Validation against metadata definition during data transfer                                               |
| Application Service Provider                                      | Implementation                                                                                                                 | Additional metadata definition                                                                            |
## 13.13.3.1.1.4  Information Report
## Prerequisites
<!-- image -->
- Data Privacy Requirement (DPP) DDIC: 2560898
- Data Privacy Requirement (DPP): 2586829
Vendor and Business Partner Where-Used Information Report ( GHO\_R\_DPP\_MAP\_PERS\_DATA )
This report shall provide a detailed where used list for the given vendor and business partner in UOM. For this, the report needs to be run with option &lt;Find Where-used Personal Data&gt; . The following technical details shall be provided:
- · Table Name and description
- · Field Name and description
- · Personal Data identifier (V, B)
- · Personal Data object ID
## 13.13.3.1.1.5  Deletion of Personal Data
## Prerequisites
##  Note
You need to implement the following notes to use Data Protection and Privacy in UOM:
- Data Privacy Requirement (DPP) DDIC: 2560898
- Data Privacy Requirement (DPP): 2586829
Simplified Blocking and Deletion : When considering compliance with data protection regulations, it is also necessary to consider compliance with industry-specific legislation in different countries. A typical potential scenario in certain countries is that personal data shall be deleted after the specified, explicit, and legitimate purpose for the processing of personal data has ended, but only as long as no other retention periods are defined in legislation, for example, retention periods for financial documents. Legal requirements in certain scenarios or countries also often require blocking of data in cases where the specified, explicit, and legitimate purposes for the processing of this data have ended, however, the data still has to be retained in the database due to other legally mandated retention periods. In some scenarios, personal data also includes referenced data. Therefore, the challenge for deletion and blocking is first to handle referenced data and finally other data, such as business partner data.
Deletion of personal data : The processing of personal data is subject to applicable laws related to the deletion of this data when the specified, explicit, and legitimate purpose for processing this personal data has expired. If there is no longer a legitimate purpose that requires the retention and use of personal data, it must be deleted. When deleting data in a data set, all referenced objects related to that data set must be deleted as well. Industry-specific legislation in different countries also needs to be taken into consideration in addition to general data protection laws. After the expiration of the longest retention period, the data must be deleted.
Upstream Operations Management might process data that is subject to the data protection laws applicable in specific countries as described in SAP Note 1825544.
The SAP Information Lifecycle Management (ILM) component supports the entire software lifecycle including the storage, retention, blocking, and deletion of data. Upstream Operations Management uses SAP ILM to support the deletion of personal data as described in the following sections.
- SAP delivers an end of purpose check for the Upstream Operations Management
- SAP delivers a where-used check (WUC) for the Upstream Operations Management
## 13.13.3.1.1.5.1  End of Purpose Check (EoP)
An end of purpose check determines whether data is still relevant for business activities based on the retention period defined for the data. The retention period of data consists of the following phases:
Phase one : The relevant data is actively used.
Phase two : The relevant data is actively available in the system.
Phase three : The relevant data needs to be retained for other reasons:
For example, processing of data is no longer required for the primary business purpose, but to comply with legal rules for retention, the data must still be available. In phase three, the relevant data is blocked.
Blocking of data prevents the business users of SAP applications from displaying and using data that may include personal data and is no longer relevant for business activities.
Blocking of data can impact system behavior in the following ways:
Display : The system does not display blocked data.
Change : It is not possible to change a business object that contains blocked data.
Create : It is not possible to create a business object that contains blocked data.
Copy/Follow-Up : It is not possible to copy a business object or perform follow-up activities for a business object that contains blocked data.
Search : It is not possible to search for blocked data or to search for a business object using blocked data in the search criteria.
It is possible to display blocked data if a user has special authorization; however, it is still not possible to create, change, copy, or perform follow-up activities on blocked data.
## 13.13.3.1.1.5.1.1  Vendor/Business Partner Replacement Utility for End of Purpose
A replacement utility is provided to make the original vendor and business partner (BP), who have met EoP with a dummy vendor or BP, anonymous. The mapping between the original and the dummy vendor and business partner is retained temporarily (until retention period) in an audit table ( GHO\_DPP\_T\_MAP ). The audit record is erased at the end of retention period. You have to run it when you decide to end the purpose for a vendor or business partner in UOM.
Following are the steps to execute the Utility report:
- Once a decision is made to end the purpose of a UOM vendor/business partner, the End of Purpose Utility report GHO\_R\_DPP\_MAP\_PERS\_DATA with option &lt;Execute End of Purpose&gt; can be initiated.
- The report presents you with a selection screen offering two fields for input: MULTIDRAG
- Type of Personal data object as Vendor or Business partner
- Original Personal data ID (Vendor/BP Number to be replaced in UOM)
- With option Execute End of Purpose
- New Dummy Personal data ID (Vendor/BP Number by which Original Vendor/BP is to be replaced)
- On providing these mandatory inputs, you can continue with the execution of the report, which replaces the original vendor or business partner in the UOM database tables with the dummy vendor/BP.
The report output gives a confirmation of replacement of Original Vendor/BP Number by the Dummy Vendor/BP Number.
The report ends by recording the timestamps of this replacement run in a database table ( GHO\_DPP\_T\_MAP ) for auditing purposes.
Make sure that you should replace one Vendor/BP at a time. During this process, there should not be made any changes in transactional data for a Vendor/BP which is being replaced.
##  Note
If EoP for a certain vendor has been met, that is, you have run Vendor Replacement Utility to replace vendor, the application will show the end-of-purpose indicator and the start-of-retention-time date based on the ILM configuration.
- If vendor is not found in UOM, the system will bring up the following status: PURPOSE\_COMPLETION\_STATUS as 1 = (no business made with Vendor at all).
- If the vendor is found in UOM and not found in the audit table (filled by UOM vendor replacement utility), application the system will bring up the following status: PURPOSE\_COMPLETION\_STATUS as 2 = (business is ongoing with Vendor).
- If vendor is not found in UOM and is found in the audit table, the system will bring up the following status: PURPOSE\_COMPLETION\_STATUS as 3 = (business is completed with Vendor).
## 13.13.3.1.1.5.2  Where-Used Check (WUC)
##  Note
The Where-Used Check functionality can be used only if you have used the Vendor/Business Partner Replacement Utility for End of Purpose tool utility tool, before you block data.
A where-used check is a simple check to ensure data integrity in case of potential blocking. The WUC for this product checks whether any dependent data for a vendor or central business partner (cBP) exists in the respective table. If dependent data exists, that is, if the data is still required for business activities, the system does not block that specific vendor or cBP.
If you still want to block the data, the dependent data must be first replaced (End of Purpose) by the replacement utility.
## 13.13.3.1.1.5.3  Process Flow
- Before destruction data, you must define residence time and retention periods in SAP Information Lifecycle Management (ILM).
- You do the following:
- Run transaction IRMPOL and maintain the required residence and retention policies for the vendor (audit area: GENERAL )/business partner(audit area: BUPA\_DP ) with ILM object GHO\_DPP\_DES\_MAP\_DELETE ).
- Run transaction BUPA\_PREPARE\_EOP to enable the end of purpose check function for the business partner.
- Run transaction CVP\_PREPARE\_EOP to enable the end of purpose check function for the vendor master.
- You delete data from mapping table and change documents by using the report GHO\_DPP\_DES\_MAP\_DELETE\_DES for the ILM objects of Upstream Operations Management.
## 13.13.3.1.1.5.4  Change Log
Person-related data is subject to frequent changes. Therefore, for revision purposes or as a result of legal regulations, it may be necessary to be able to track the changes made. If these changes are logged, at any time you can check which employee made which change and when.
Change log has been enabled for Vendor Specific fields in UOM. You can execute program RSSCD200 to get the change information of these documents.
## Related Information
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Services for Application Developers into the search bar, press Enter , open the search result with that title, and navigate to Change Documents .
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Security Aspects for Lifecycle Management into the search bar, press Enter , open the search result with that title, and navigate to Auditing and Logging .
## 13.13.3.1.2  IS-OIL Downstream
## 13.13.3.1.2.1  Internet Communication Framework Security (ICF)
You should only activate those services that are needed for the applications running in your system. For the Fiori apps in the TSW area, following services are needed:
- My Nominations - TSW\_MYNOMINATIONS\_SRV\_01
- Regional Inventory View - SW\_REGIONAL\_INVENTORY\_SRV\_01
- Mass Change Events - TSW\_MYEVENTS\_SRV
- TSW Tickets -TSW\_TICKETS\_SRV
- My Nomination Tickets - TSW\_NOMINATIONTICKETS\_SRV
- Supply Chain Visualization -TSW\_VISUAL\_SHIPMENT\_SRV, VBI\_APPL\_DEF2\_SRV
- Physical Inventory Capture IOG - Volume/Mass Reading - OIL\_HPM\_DS\_PHYINVVMRAPP\_SRV
- Physical Inventory Capture IOG - Gauge Reading - OIL\_HPM\_DS\_PHYINV\_GR\_SRV
- Mobile Ticket Data Capture - TSW\_MULTI\_CHANNEL\_TICKET
- Laytime and Demurrage - CMH\_LAYTIMEDEMURRAGE\_SRV
- Schedule Hydrocarbon Trips - CMH\_SCHDULEHYCTRIPS\_SRV
- Scheduling Assistant - TSW\_SCHEDULINGASSISTANT\_SRV
- Mobile Event Data Capture - TSW\_MOBILE\_EVENTS\_SRV
Use the transaction SICF to activate these services.
If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
For more information about ICF security, see the respective chapter in the ABAP Platform Security Guide.
## 13.13.3.1.2.3  Read Access Logging
If no trace or log is stored that records which business users have accessed data, it is difficult to track the person(s) responsible for any data leaks to the outside world. The Read Access Logging ( RAL ) component can be used to monitor and log read access to data and provide information such as which business users accessed personal data, for example, of a business partner, and in which time frame.
IS-OIL Downstream provides Read Access Logging configuration for IS-OIL TD Driver License Number. For more information, see SAP Note 2609910.
Read Access Logging is activated for the Display Driver transaction.
In RAL, you can configure which read-access information to log and under which conditions.
For general information on Read Access Logging, go to https:/ /help.sap.com/s4hana\_op\_2021, open the product assistance, and navigate to Cross Components Data Protection Security Safeguards Regarding Data Protection Read Access Logging (RAL) .
## 13.13.3.1.2.4  Information Retrieval
Data subjects have the right to get information regarding their personal data undergoing processing. The information retrieval feature supports you to comply with the relevant legal requirements for data protection by allowing you to search for and retrieve all personal data for a specified data subject. The search results are displayed in a comprehensive and structured list containing all personal data of the data subject specified, subdivided according to the purpose for which the data was collected and processed.
## More Information
For more details on the implementation of Information Retrieval for IS- OIL Downstream , refer to the steps in the SAP Note 2959312 , to create and enable IRF models.
## 13.13.3.1.3  Remote Logistics Management
## 13.13.3.2  Utilities
This chapter lists security-relevant aspects that have to be considered when using the SAP Utilities solution.
##  Note
In addition to the topics below, please also see the chapter Billing and Revenue Innovation Management [page 134] in this guide.
## 13.13.3.2.1  Data Storage Security
## Using Logical Path and File Names to Protect Access to the File System
The Industry Solution Migration Workbench (ISMW) saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
## Logical File Names / Path Names Used
The Migration Workbench (ISMW) uses the logical file name ISMW\_FILE with the logical file path ISMW\_ROOT to enable the validation of physical file names.
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). T o find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log.
For more information, see about data storage security, see the respective chapter in the SAP NetWeaver Security Guide.
## 13.13.3.2.2  Enterprise Services Security
For general information, see the chapters on Web Services Security in the SAP NetWeaver Security Guide. For Utilities-specific processes, during which system-to-system communication (A2A communication) takes
place within a system landscape and processes that prepare for market communication with other market participants as part of intercompany data exchange, note the following:
##  Note
If, as part of your company-specific processes, you have communication interfaces with other systems, you must also take their recommended security measures into account.
## A2A Communication Within a System Landscape
During A2A communication, data is exchanged between an SAP system and an external system. This communication is based on enterprise services and can flow via a PI system as a data hub or directly between the respective systems (point-to-point). As identifying parameters, the SAP system uses internal values (such as the profile number) or parameters that are generally understood in the market (such as external point of delivery IDs). For information about the security measures relevant to A2A communication, see the SAP NetWeaver Security Guide. The authorization objects of the respective transactions provide these processes with additional security.
## Market Communication in Intercompany Data Exchange
As part of intercompany data exchange, messages are sent from an SAP Utilities system to a PI system or a comparable upstream system to prepare for market communication with other market participants. The messages are then converted into a universally valid market format and sent on to other systems. As identifying parameters, the SAP system uses values that are generally understood in the market (such as external point of delivery IDs). Communication can take place using enterprise services or IDocs (ALE communication).
For more information about the necessary security measures, see the SAP NetWeaver Security Guide. The authorization objects of the respective transactions provide these processes with additional security.
## 13.13.3.2.4  Read Access Logging
The Read Access Logging ( RAL ) component can be used to monitor and log read-access to data and provide information such as which business users accessed personal data, for example, for a business partner, and when they did so.
In RAL, you can configure which read-access information is to be logged and the conditions under which you should do so. SAP delivers sample configurations for applications.To use these configurations, save the ZIP attachments from the SAP Note 2370371 . Extract these ZIP files and import the RAL configurations using the import function for configurations in transaction SRALMANAGER .
For general information on Read Access Logging, go to https:/ /help.sap.com/s4hana\_op\_2021, open the product assistance, and navigate to Cross Components Data Protection Security Safeguards Regarding Data Protection Read Access Logging (RAL) .
## 13.13.3.2.5  SAP Waste &amp; Recycling
## 13.13.3.2.5.1  Internet Communication Framework Security
You should only activate those services that are needed for the applications running in your system. For SAP Waste and Recycling the service EHWV\_WASTE is needed. Use the transaction SICF to activate the service.
If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
For more information about Internet Communication Framework Services, go to https:/ /help.sap.com/ s4hana\_op\_2021, enter Activating and Deactivating ICF Services into the search bar, press Enter , and open the search result with that title.
## 13.13.3.2.6  Multichannel Foundation for Utilities and Public Sector
## 13.13.3.2.6.2  Internet Communication Framework Security (ICF)
Security for the Multichannel Foundation for Utilities and Public Sector solution consists of SAP Gateway OData services and HTML5/SAP UI5-based Web-enabled content managed by the Internet Communication Framework (ICF) (transaction SICF ).
You must activate the ICF services required for the applications you want to use.
##  Note
You can also activate these services during the technical configuration.
The Multichannel Foundation for Utilities and Public Sector solution relies on the following services in SAP CRM:
- UMCUI5 : An HTML5/SAP UI5-based Web-enabled interface to access the OData services
- CRM\_UTILITIES\_UMC : OData services from the SAP CRM system
- CRM\_UTILITIES\_UMC\_URM : Multichannel Foundation for Utilities and Public Sector extension of the SAP Gateway USERREQUESTMANAGEMENT OData service
- CRM\_UTILITIES\_UMC\_PUBLIC\_SRV : Anonymous OData Service for products in SAP CRM
- ERP\_UTILITIES\_UMC\_URM (logon user UMC\_SRV\_USR ): OData services from the SAP S/4HANA system
In addition, the application also uses service USERMANAGEMENT from SAP Gateway.
The Multichannel Foundation for Utilities and Public Sector S/4HANA stand-alone solution relies on the following services:
- ERP\_ISU\_UMC (logon user/current user): Multichannel Foundation for Utilities and Public Sector extension of the Gateway USERREQUESTMANAGEMENT OData Service
- ERP\_UTILITIES\_UMC : OData services from the SAP S/4HANA system
- ERP\_ISU\_UMC\_PUBLIC (logon user UMC\_SRV\_USR )
In addition, the application also uses the service USERMANAGEMENT from SAP Gateway.
## Related Information
Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Security Guides for Connectivity and Interoperability Technologies into the search bar, press Enter , and open the search result with that title.
## 13.13.3.2.6.3  Data Protection and Privacy
Data Protection and Privacy
## Use
The Multichannel Foundation for Utilities and Public Sector application uses session cookies. For more information, see ICF and Session Security [page 21].
##  Recommendation
You are recommended to activate secure session management and to use SSL to protect the network communications where these security-relevant cookies are transferred.
User request data is stored in SAP Gateway for processing. Depending on business needs and local regulations, you can delete some user requests after certain periods of time.
The Multichannel Foundation for Utilities and Public Sector solution is built upon SAP Gateway. To ensure your data is protected and cannot be accessed by anyone, we recommend that you refer to the SAP Gateway Foundation Security Guide .
Go to https:/ /help.sap.com/s4hana\_op\_2021, enter SAP Gateway Foundation Security Guide into the search bar, press Enter , open the search result with that title, and navigate to Auditing and Logging .
## 13.13.3.2.6.4  Read Access Logging
Read Access Logging
Use
The Read Access Logging (RAL) component can be used to monitor and log read-access to data and provide information such as which business users accessed personal data, for example, for a business partner, and when they did so.
In RAL, you can configure which read-access information is to be logged and the conditions under which you should do so. SAP delivers sample configurations for applications. To use these configurations, save the ZIP attachments from the SAP Note 2370371. Extract these ZIP files and import the RAL configurations using the import function for configurations in transaction SRALMANAGER.
SAP Note 2373081 provides example content for RAL in Multichannel Foundation for Utilities and Public Sector that allows you to choose the attributes relating to bank account data or payment card data that are to be logged for each read access.
For general information on Read Access Logging, go to https:/ /help.sap.com/s4hana\_op\_1909, open the product assistance, and navigate to Cross Components Data Protection Security Safeguards Regarding Data Protection Read Access Logging (RAL) .
## 13.13.3.2.7  SAP S/4HANA Utilities Integration with SAP Marketing Cloud
## 13.13.3.2.7.1  Consent
It is the responsibility of the utility company that uses the SAP S/4HANA Utilities integration with SAP Marketing Cloud solution to request and obtain consent of the data subjects (a natural person such as a customer, contact, or account) to use their personal data before replicating their business partner data from SAP S/4HANA Utilities to SAP Marketing Cloud. It is assumed that the users of SAP Marketing Cloud (for example, customers of SAP for Utilities solutions) have consent from their data subjects to transfer data from SAP S/4HANA Utilities to SAP Marketing Cloud for the purpose of marketing.
Before data gets transmitted from SAP S/4HANA Utilities for replication, the SAP S/4HANA Utilities integration with SAP Marketing Cloud offers the possibility to perform consent checks for the replication of the following objects:
- Contracts
- Interactions
- General data
- Sales contracts
- Utilities customer scores data
- Installation data
By enabling consent checks for those objects, data replication will only be performed on data that belongs to data subjects who have granted consent for marketing purposes. Consent checks for those objects can be enabled through Customizing.
The SAP S/4HANA Utilities integration with SAP Marketing Cloud only performs the consent checks against the consent records that are stored in Consent Administration of SAP S/4HANA. Therefore, you are required to maintain the consent records in Consent Administration of SAP S/4HANA. If you use another consent administration application, you must make sure to regularly import the consent records from that consent administration application into Consent Administration of SAP S/4HANA. For more information, see Consent Administration [page 36].
## Important SAP Notes
The following table lists important SAP Notes regarding consent:
Title
Profiling Consent Check for Utilities Customer Score for SAP S/4HANA Utilities Integration with SAP Marketing Cloud
SAP Note
<!-- image -->
<!-- image -->
| Title                                                                                                        |   SAP Note |
|--------------------------------------------------------------------------------------------------------------|------------|
| Consent Withdrawal for Interaction Contacts Originating from Business Partner and Contract Account Data      |    3074944 |
| Consent Check for Business Partner and Contract Account for SAP S/4HANA Integration with SAP Marketing Cloud |    3048468 |
## 13.13.3.2.7.2  Deletion of Personal Data
Users can ask for deletion of their personal data. In addition, data can also automatically be deleted after a certain retention period to accommodate the user's right to be forgotten. To fulfill this requirement, the SAP S/4HANA Utilities integration with SAP Marketing Cloud replicates the business partner blocking and deletion events to SAP Marketing Cloud. For follow-on processing and handling of these events on SAP Marketing Cloud, see the Administration Guide of SAP Marketing Cloud and search for Deletion .
## Deletion of Agreements
When the end date of a utilities contract or a sales contract is reached, the corresponding marketing agreement remains on SAP Marketing Cloud. To maintain data integrity on SAP Marketing Cloud, it is the responsibility of the utility to clean the data on SAP Marketing Cloud, by deleting the agreement and agreement terms that are representing utilities contracts and sales contracts that have reached their end date.
## 13.13.3.2.7.3  Communication Channel Security
The SAP S/4HANA Utilities integration with SAP Marketing Cloud sends information to SAP Cloud Platform Integration for processing. Then, SAP Cloud Platform Integration sends the processed information to SAP Marketing Cloud.
The following table shows the communication paths used by the SAP S/4HANA Utilities integration with SAP Marketing Cloud, the protocols used for the connection, the types of data transferred, and the data that require special protection:
| Communication Path               | Protocol Used   | Type of Data Transferred                                 | Data Requiring Special Pro- tection                             |
|----------------------------------|-----------------|----------------------------------------------------------|-----------------------------------------------------------------|
| SAP Cloud Platform Integra- tion | SOAP            | Utilities technical master data and business master data | Business master data and personally indentifiable infor- mation |
| SAP Marketing Cloud              | OData           | Utilities technical master data and business master data | Business master data and personally identifiable infor- mation  |
SOAP connections are protected with Web services security. Secure Sockets Layer (SSL) protocol protects OData HTTP communications.
## 13.13.3.2.7.4  Authorizations
The SAP S/4HANA Utilities integration with SAP Marketing Cloud uses the authorization concept provided by the SAP NetWeaver Application Server for ABAP (SAP NetWeaver AS for ABAP) component. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS for ABAP Security Guide also apply to the SAP S/4HANA Utilities integration with SAP Marketing Cloud.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. To maintain roles, use transaction PFCG to launch the Profile Generator on SAP NetWeaver AS for ABAP.
## Data Replication Framework Authorizations
In the SAP S/4HANA Utilities integration with SAP Marketing Cloud, the Creating Outbound Messages ( DRF\_ADM ) authorization object is checked to determine whether the user is authorized to use the DRFOUT transaction to trigger data replication.
## Service Role and User for SAP Business Workflow
The SAP\_WFRT user with the SAP Business Workflow: Service User ( SAP\_BC\_BMT\_WFM\_SERV\_USER ) role is delivered with the SAP S/4HANA system. This user is required and responsible for executing the SAP Business Workflow functions. In the context of the SAP Marketing Cloud solution, this user calls the function modules that are bound to certain Business Object Repository (BOR) events.
## 13.13.3.2.7.5  Security for Additional Application
## Certificate-Based Authentication with SAP Cloud Platform Integration
In the SAP S/4HANA Utilities integration with SAP Marketing Cloud, SAP S/4HANA Utilities communicates with SAP Cloud Platform Integration services by way of SOAP Web services (transaction SOAMANAGER ). The communication channel between SAP S/4HANA Utilities and SAP Cloud Platform Integration is secured by HTTPS SSL encryption.
To establish secure communications between the SAP S/4HANA Utilities system and SAP Cloud Platform Integration, you must obtain the server certificate from SAP Cloud Platform Integration and then use the Trust Manager (transaction STRUST ) to import it into the SAP S/4HANA Utilities system.
## SAP S/4HANA Utilities Integration with SAP Marketing Cloud
The SAP S/4HANA Utilities integration with SAP Marketing Cloud should be used in conjunction with the SAP S/4HANA Integration with SAP Marketing Cloud integration package. This package is used to execute the replication of business partner data and product data from an SAP S/4HANA system to an SAP Marketing Cloud system. For more information about this integration package, see SAP API Business Hub and search for SAP S/4HANA Integration with SAP Marketing Cloud .
## 13.13.3.2.8  Utilities Product Integration Layer
## Authorizations
The Utilities Product Integration Layer (UPIL) uses the authorization concept provided by the SAP NetWeaver Application Server for ABAP (SAP NetWeaver AS for ABAP) component and SAP HANA business data platform. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS for ABAP Security Guide and SAP HANA apply to the UPIL. The SAP authorization concept is based on assigning authorizations to users based on roles.
## 13.13.3.2.9  S/4HANA Utilities for Customer Management
The SAP S/4HANA Utilities for Customer Management package supports business-to-consumer (B2C) contract management for residential customers. For residential customers, processes such as selling energy products, changing budget billing plans, entering meter reading results, starting market communication, correcting bills, and changing master data are offered.
## Deletion of Personal Data
In SAP S/4HANA Utilities for Customer Management there is a special contract type to process customer management processes: the Utilities Sales Contract . This contract stores personal data related information within a reference to an IS-U contract.
For deletion process based on ILM there can be used the ILM object CRMS4\_IUCH .
If you want to add company specific settings, you can create your own report and use this one as a template. For more information, see the Data Protection and Privacy [page 31] section.
## Information Retrieval
Based on the ILM object CRMS4\_IUCH there can be used the shipped model (same name: CRMS4\_IUCH ) for the Information Retrieval Framework (IRF) to provide relevant personal related data currently existing in the system.
## Read Access Logging
Read Access Logging for SAP S/4HANA Utilities for Customer Management. You can configure which readaccess information to log and under which conditions. SAP delivers sample configurations for applications. In order to use these configurations, save the ZAIP attachments form the SAP Note 2369386 . Extract these ZIP files and import the RAL configurations using the import function for configurations in transaction SRALMANAGER .
## 13.13.4  Financial Services
## 13.13.4.1  Banking
## 13.13.4.1.1  SAP Business Partner for Financial Services (FSBP)
The security policy with SAP Business Partner for Financial Services (FS-BP) is very similar to the security policy with the central SAP Business Partner ( SAP BP ).