orkungedik/SAP-basis-dataset huggingface dataset:
## 12.3.2.1  Deletion of Personal Data
Behavioral Insights might process data that is subject to the data protection laws that apply in specific countries as described in the SAP note, Simplified Deletion and Blocking of Personal Data in SAP Business Suite (SAP note number 1825544).
Behavioral Insights provides SAP NetWeaver Information Lifecycle Management (ILM)-based archiving and deletion features for the following entities:
- BEI\_PRESULT\_H
- BEI\_PRESULT\_I
- BEI\_EXT\_EVENT
Business partner records are archived when the business purpose of the business partners is completed. The archiving process is based on the residence rules defined for each data object. Data is archived until the retention period expires and the data is then also deleted from the archive store.
Residence and retention rules are defined according to the value specified in the Time Reference field that is maintained for the ILM object. These rules can differ based on the value specified in the Condition Field , that is maintained in the ILM object.
The following table displays the archiving ILM objects in Behavioral Insights with their corresponding details:
| Archiving object/ILM object   | Tables                  | Time Reference Field   | Condition field   | Programs                    |
|-------------------------------|-------------------------|------------------------|-------------------|-----------------------------|
| BEI_PRSLT                     | BEI_PRSLT_H BEI_PRSLT_I | PREDICTION_DATE- TIME  | SCENARIO_ID       | BEI_PRSLT_WRI BEI_PRSLT_DEL |
|                               |                         |                        |                   | BEI_PRSLT_READ              |
| BEI_EXTEVT                    | BEI_EXT_EVENT           | EVENT_END_DATE         | EVENT_ID          | BEI_EXTEVT_WRI              |
|                               |                         |                        |                   | BEI_EXTEVT_DEL              |
|                               |                         |                        |                   | BEI_EXTEVT_READ             |
For more information about archiving and deleting data, see the information outlined in the SAP Data Archiving Guide .
## Capability
The source tables and ILM objects in which deletion of data is possible are shown below:
| Source Table   | ILM Object   |
|----------------|--------------|
| BEI_PRESULT_H  | BEI_PRSLT    |
| BEI_PRESULT_I  | BEI_PRSLT    |
| BEI_EXT_EVENT  | BEI_EXTEVT   |
## Authorization
The standard authorization objects that are required to schedule archiving jobs are as follows:
- S\_ARCHIVE
- S\_BTCH\_JOB
- S\_BTCH\_ADM
For more information about authorization and roles for archiving, see the User Administration and Authentication and the Deletion of Personal Data sections in the Security Guide for SAP S/4HANA.
Deletion of Business Partner in SAP Marketing Cloud
Once a business partner is marked for end of purpose in SAP S/4HANA, you can use the information detailed in the Payload Examples section of the Integration Guide for SAP Marketing Cloud, to delete the business partners in SAP Marketing Cloud.
## 12.3.2.3  Change Logs
Whenever the records in the configuration tables are updated or deleted, this activity is logged in the ABAP platform using the standard change document feature. Change documents facilitate auditing and can be used to log what has changed, and when and how the changes were made.
Configuration change logs can only be accessed using the SCU3 transaction by the user who has the necessary authorization. An application-specific authorization group BEIC , is assigned to all configuration tables, which is associated with the standard authorization object S\_TABU\_DIS . Only a user who has been assigned the PFCG role, which is mapped to the authorization object S\_TABU\_DIS and where the authorization group field value is set as BEIC , can view the configuration change logs.
## 12.3.2.4  Information Retrieval
Data subjects have the right to obtain information about their data that is being processed. The information retrieval feature allows you to comply with the relevant legal requirements for data protection by allowing you to search for and retrieve all personal data for a specified data subject. The search results are displayed in a comprehensive and structured list containing all personal data for the data subject, subdivided according to the purpose for which the data was collected and processed.
## Process
Perform the following steps to create and enable the IRF models:
1. Generate the data model using the DTINF\_ADJUST\_MODEL transaction.
2. Create a purpose using the DTINF\_MAINTAIN\_PURP transaction to collect the data.
3. Run the data collection report using the DTINF\_START\_COLL transaction to trigger the information retrieval process.
4. Process the data collection results report using the DTINF\_PROC\_COLL transaction to see an overview of all data collection requests and to display and download the search results.
Information retrieval is implemented using the standard SAP NetWeaver Information Retrieval Framework (IRF) and the IRF implementation is based on the ILM objects. Data is retrieved for the tables defined in the ILM object. BUT000 is the business partner master data table and the source table for information retrieval of data in Behavioral Insights.
The following table displays the ILM objects, the source table and the Behavioral Insights-specific tables that are used for the information retrieval process:
| ILM object   | Source table   | Behavioral Insights tables   |
|--------------|----------------|------------------------------|
| BEI_PRSLT    | BUT000         | BEI_PRSLT_H, BEI_PRSLT_I     |
| BEI_EXTEVT   | BUT000         | BEI_EXT_EVENT                |
## 13 SAP S/4HANA Enterprise Business Applications
## 13.1 Asset Management
## 13.1.1  Maintenance Operations
## 13.1.1.1  Authorizations in Plant Maintenance
## Standard Roles
SAP delivers business role templates which follow the naming convention SAP\_BR\_*. The delivered business role templates are designed to cover typical activities of business users with a certain job profile.
## Example
The delivered business role template SAP\_BR\_MAINTENANCE\_TECHNICIAN is designed for maintenance technicians. The role contains business catalogs which cover all the functions that a maintenance technician requires to carry out their work effectively and safely.
Another example business role template SAP\_BR\_MAINTENANCE\_PLANNER is designed for maintenance planners. The role contains business catalogs which cover a broad range of functions necessary for planning and executing maintenance activities.
Each business catalog contains one or more applications and is designed to support segregation of duty.
##  Note
For more information about how to create roles, see Role Administration [page 13].
## 13.1.2  Resource Scheduling
## 13.1.2.1  Deletion of Personal Data in Resource Scheduling
## Use
SAP S/4HANA Asset Management for resource scheduling might process data (personal data) that is subject to the data protection laws applicable in specific countries.
For more information about data protection, see the product assistance for SAP S/4HANA on SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                                  | Provided Deletion Functionality                                                                                                                                                                                                                                     |
|----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Resource Scheduling for Maintenance Planners | Using these SAP Fiori apps, app users assign work centers                                                                                                                                                                                                           |
| Manage Work Center Utilization               | to themselves. This is a prerequisite for using the resource scheduling apps.                                                                                                                                                                                       |
| Maintenance Scheduling Board                 | If you have the required authorization (authorization ob- ject RSH_US_DEL ), you can delete these work center as- signments for any app user. To do so, use the Deletion of Work Center Assignments in Resource Scheduling report ( RSH_DELETE_EAM_USER_SETTINGS ). |
|                                              |  Note Use transaction SE38 in the back-end system to execute the report. For more detailed information, see the report documentation in the system.                                                                                                                |
## 13.2 Finance
## 13.2.1  Financial Accounting
## Network and Communication Security
Communication with external systems takes place using the standard channels provided by SAP basis technology:
- Application Link Enabling(ALE)/IDoc
- Standard interfaces to BI, CRM, and SRM systems
- Batch-Input Ensure that no unauthorized access can take place at the time of data transfer using encryption and with
the help of your network.
- Remote Function Call(RFC) / Business Application Programming Interface (BAPI)
- File Interface Ensure that no unauthorized access can take place at the time of data transfer using encryption and with
the help of your network.
- SAP Process Integration (PI)
- E-mail, fax
<!-- image -->
##  Example
- Financial Accounting has interfaces to Taxware and Vertex software used for performing tax calculations.
- Electronic advance return for tax on sales/purchases:
- There is an interface for the electronic advance return for tax on sales and purchases using Elster . Communication takes place by means of XI.
- You can digitally sign the electronic advance return for tax on sales/purchases.
- Payments and payment advice notes are dispatched using IDoc, and dunning notices are sent by e-mail or fax.
## Communication Destinations
All the technical users generally available can be used.
## Data Storage Security
Many of the Financial Accounting transactions access sensitive data. Access to this kind of data, such as financial statements, is protected by standard authorization objects.
## 13.2.1.2  General Ledger Accounting (FI-GL)
## 13.2.1.2.3  Authorizations
## Standard Authorization Objects for Accounting Enhancements for Banking
The table below shows the security-relevant autorizations:
| Authorization Object   | Field   | Value   | Description                                                                          |
|------------------------|---------|---------|--------------------------------------------------------------------------------------|
| GLE_ADB_GR             | ACTVT   | 16      | Execute and persist Average Daily Balance calculation for group reporting            |
|                        |         | 48      | Execute Average Daily Bal- ance calculation for group re- porting in simulation mode |
| GLE_ECS                | ACTVT   | 2       | Change ECS Document Item                                                             |
|                        |         | 3       | Display ECS Document Item                                                            |
|                        |         | 6       | Delete ECS Document Item                                                             |
|                        |         | 36      | Extended maintenance                                                                 |
|                        |         | 43      | Approve ECS Document Item                                                            |
|                        |         | 96      | Reject ECS Document Item                                                             |
|                        |         | A8      | Process mass activity on ECS documents                                               |
## 13.2.1.3  Bank Accounting (FI-BL)
## Important SAP Notes
For a list of additional security-relevant SAP HotNews and SAP Notes, see the SAP Support Portal at http:/ / support.sap.com/securitynotes .
## 13.2.1.4  Asset Accounting (FI-AA)
## Important SAP Notes
For a list of additional security-relevant SAP HotNews and SAP Notes, see the SAP Support Portal at http:/ / support.sap.com/securitynotes .
## Standard Roles
| Role                   | Description                         |
|------------------------|-------------------------------------|
| SAP_BR_AA_ACCOUNTANT   | Asset Accountant                    |
| SAP_AUDITOR_BA_FI_AA   | AIS Fixed Assets                    |
| SAP_AUDITOR_BA_FI_AA_A | AIS - Fixed Assets (Authorizations) |
## Standard Authorization Objects
For the list of standard authorization objects available for Asset Accounting, see transaction SU21 , Object Class Asset Accounting ( AM ).
## Network and Communication Security
Asset Accounting provides BAPIs for communicating with third-party systems.
## Communication Destinations
For workflow tasks, you sometimes need either the WF-BATCH user or a user that you can use for background steps of this kind. To execute the decision steps required before reaching these background steps, you need a user that is explicitly assigned.
## 13.2.1.6  Corporate Close - Consolidation Foundation
## 13.2.1.6.1  Deletion of Personal Data
## Use
The Real-Time Consolidation (FIN-RTC) component in SAP S/4HANA might process data (personal data) that is subject to the data protection laws applicable in specific countries.
## Relevant Application Objects and Available Deletion Functionality
| Application                                                                                                         | Provided Deletion Functionality   |
|---------------------------------------------------------------------------------------------------------------------|-----------------------------------|
| Consolidation Methods • Transaction codes RTCTM and RTCRM • Fiori App Define Validation Methods                     | RTC_DPP_METHOD                    |
| Consolidation Models (transaction code RTCMD )                                                                      | RTC_DPP_MODEL                     |
| Validation Rules (Fiori app Define Validation Rules )                                                               | RTC_DPP_VALIDATION_RULE           |
| Data Release Lock (Fiori app Consolidation Data Release Monitor )                                                   | RTC_DPP_DATA_RELEASE_LOCK         |
| Data Release Requests • Fiori app Consolidation Data Release Cockpit • Fiori app Consolidation Data Release Monitor | RTC_DPP_DATA_RELEASE_REQUEST      |
| Rule Result Comments (Fiori app Consolidation Data Release Cockpit )                                                | RTC_DPP_RULE_RESULT_COMMENTS      |
Task Logs (all programs that run currency translation and post journal entries, for example, transaction code RTCCT and Fiori app Consolidation Data Release Cockpit )
<!-- image -->
##  Note
For the deletion programs mentioned in the table above, you can also Display Records .
## Run Deletion Programs
SAP recommends scheduling regular jobs to run the deletion programs using the Define Background Job ( SM36 ) transaction.
## 13.2.1.7  Corporate Close - Group Reporting
## 13.2.1.7.1  Deletion of Personal Data
## Use
The Group Reporting ( FIN-CS ) component in SAP S/4HANA might process data (personal data) that is subject to the data protection laws applicable in specific countries.
## Procedure
You can use the app Data Protection for Consolidation (transaction code CXDPP ) to anonymize user information and delete personal data for data protection purposes.
You can anonymize user data in the following records by selecting Anonymize Information and a time period:
- Task Logs
- Replication of Flow Data
- Replication of Hierarchies
RTC\_DPP\_TASK\_LOG
- Data Monitor Status
- Data Entry Layouts
- Consolidation Monitor Status
- Validation Parsing
- Rules Parsing
- Methods
- Global Parameters
- Activation of Analysis Help
- Consolidation Unit, Name
- Consolidation Unit, Contact Person
You can select the option Delete Data Records for data in Global Parameters and Activation of Analysis Help .
You can select Display Data Records to view the user data included in the data records mentioned in the table above.
## 13.2.1.7.2  Virus Scanning
You can activate and set up a virus scan interface of your choice. When you upload an xls spreadsheet, make sure that the virus scanner you selected detects xls-bombs (like zip bombs).
For more information see Virus Scanning [page 24].
## 13.2.1.7.3  Allowlisting
For the Import Consolidation Master Data app, the following MIME Type is on the allowlist:
- application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.
Make sure that you have included the above mentioned MIME Type in the allowlist.
For more information, see General Recommendations for Virus Scan Profiles [page 24].
## 13.2.1.7.4  Malicious Content
If the virus scanner detects malicious content when uploading and importing data in the Import Consolidation Master Data app, the process is terminated. SAP recommends that customers do not turn off this function.
## 13.2.1.8  Central Finance (FI-CF)
The following functions are available for Central Finance:
## Schedule Clean-Up Report in Source System
Data relating to FI/CO documents is temporarily stored in log tables in the source system before it can be transferred to Central Finance. To delete the temporary information from these tables, a clean-up program ( RFIN\_CFIN\_CLEANUP ) is run and must be scheduled regularly (for example, once a month). In the configuration of this program, you can define for how many periods a temporarily stored data record is kept before being deleted by the clean-up program (for example, so that an incorrect posting can be corrected).
## Read Access Log for the Application Log
The application log for the Central Finance initial load may contain sensitive, personal data. Therefore, we provide a read access log for this application log ( CFIN\_INITIAL\_LOAD ) for the channel DYNP .
## 13.2.1.9  Joint Venture Accounting
## 13.2.1.9.1  Deletion of Personal Data in Joint Venture Accounting
## Use
The Joint Venture Accounting component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Available Deletion Functionality
| Application Object         | Provided Deletion Functionality                 |
|----------------------------|-------------------------------------------------|
| Joint Venture partner data | Data destruction object JVA_PARTNER_DESTRUCTION |
For more information, see https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Finance Accounting and Financial Close Joint Venture Accounting Data Destruction in Joint Venture Accounting .
## Relevant Application Objects and Available End of Purpose Check
| Application Object         | Implemented Solution       | Further Information                                                     |
|----------------------------|----------------------------|-------------------------------------------------------------------------|
| Joint Venture partner data | End of Purpose Check (EoP) | The EoP check is integrated into the ILM objects                        |
|                            |                            | • FI_ACCRECV (customer master data) for checking customer mas- ter data |
|                            |                            | • FI_ACCPAYB (vendor master data) for checking vendor master data       |
For more information, see https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Finance Accounting and Financial Close Joint Venture Accounting End of Purpose Check (EoP) for Business Partner .
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of Joint Venture partner data in Customizing under Cross-Application Components Data Protection .
## 13.2.1.9.2  Deletion of Personal Data in Project Risk Management for Contractors
## Use
The Project Risk Management for Contractors component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Available Deletion Functionality
| Application Object         | Provided Deletion Functionality                   |
|----------------------------|---------------------------------------------------|
| Joint Venture partner data | Data destruction object /SAPPCE/JVA_PARTNER_DESTR |
For more information, see https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Finance Accounting and Financial Close Joint Venture Accounting Project Risk Management for Contractors Data Destruction .
## Relevant Application Objects and Available End of Purpose Check
| Application                | Implemented Solution       | Further Information                                                                                                                                                                        |
|----------------------------|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Joint Venture partner data | End of Purpose Check (EoP) | The EoP check is integrated into the ILM objects • FI_ACCRECV (customer master data) for checking customer mas- ter data • FI_ACCPAYB (vendor master data) for checking vendor master data |
For more information, see https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Finance Accounting and Financial Close Joint Venture Accounting Project Risk Management for Contractors End of Purpose Check (EoP) for Business Partner .
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of Joint Venture partner data in Customizing under Cross-Application Components Data Protection .
## 13.2.2  Controlling
## 13.2.2.1  Deletion of Personal Data in Controlling
## Use
The Controlling (CO) component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/ 4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Cross Components Data Protection .
## Available Deletion Functionality
ILM Objects in Controlling (CO)
| ILM Object   | Description                                       |
|--------------|---------------------------------------------------|
| CO_ALLO_ST   | Completely canceled documents contrib., val., ... |
| CO_CCMAST    | Cost Center Master Data                           |
| CO_CEL_RCL   | Reconciliation ledger: Totals and line items      |
| CO_COPC      | Archiving Product Costing Data                    |
| CO_ORDER     | Orders with transaction data                      |
| CO_PROCESS   | Business process, including transaction data      |
| CO_TRANS     | COLine Items and Totals                           |
| COPAA_XXXX   | Costing-based line items (Transaction: KE0I)      |
| COPAB_XXXX   | Costing-based object level (Transaction: KE0I)    |
| ILM Object   | Description                                  |
|--------------|----------------------------------------------|
| COPA2_XXXX   | Account-based line items (Transaction: KE0I) |
| COPAC_XXXX   | Profitability segments (Transaction: KE0I)   |
| PM_ORDER     | Service and Maintenance Orders               |
| FICO_MYUSLOG | MyUnusual Items                              |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
## 13.2.2.2   Network and Communication Security
Controlling is integrated with Microsoft Office .For information on security aspects with Microsoft Office applications, refer to the documentation of those products.
Communication in Manager Self-Service (MSS) and in the Web Application for the Business Unit Analyst (BUA) is based on Remote Function Calls (RFCs).
## 13.2.2.2.1   Communication Destinations
Technical users are required for communication over ALE, for batch reporting, and for third-party providers that access Controlling data.
## 13.2.3  Governance, Risk and Compliance for Finance
## 13.2.3.1  International Trade
The following security information applies to SAP S/4HANA for international trade only.
## 13.2.3.1.1  Intrastat
## Related Information
Personal Data in Intrastat Declarations [page 80]
Manage Authorizations for Generic UIs for Intrastat [page 80]
## 13.2.3.1.1.1  Personal Data in Intrastat Declarations
Personal data of the contact person of the provider of information, for example first name, last name and e-mail address, is written into Intrastat declaration files to be compliant with the file formats defined by authorities. These file formats are country-specific and can be changed by authorities at any time.
Intrastat declaration files are saved outside the SAP S/4HANA system. Therefore, the management of those files and the deletion of personal data in those files must be done outside the SAP S/4HANA system.
## 13.2.3.1.1.2  Manage Authorizations for Generic UIs for Intrastat
## Related Information
Generic UIs - Application Job for Intrastat [page 80]
## 13.2.3.1.1.2.1  Generic UIs - Application Job for Intrastat
## Context
On the back-end server, you have to assign the OData service authorization to a PFCG role. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Creating Authorization Roles for Catalogs into
the search bar, press Enter , and open the search result with that title. In addition, manual actions are required.
1. Assign Fiori catalog to PFCG role.
2. Assign additional authorization default for required application job catalog entry.
3. Fill authorization field P\_PROGNAM with report name for authorization object S\_PROGNAM
| Business Catalog          | Application Job Catalog En- try   | Report Name   | Fiori ID                                                                |
|---------------------------|-----------------------------------|---------------|-------------------------------------------------------------------------|
| SAP_SLL_BC_INTRASTAT_S EL | SAP_SD_FT_RVEXST00                | RVEXST00      | F2507 Select Dispatches and Customer Returns - Intrastat Declaration    |
| SAP_SLL_BC_INTRASTAT_S EL | SAP_MM_FT_RMIMST00                | RMIMST00      | F2508 Select Receipts and Returns to Supplier - Intra- stat Declaration |
## 13.2.3.1.1.3  Dependent Business Catalog for Intrastat
You can manage authorization fields in PFCG role by using transaction PFCG. The authorization field is used in Business Partner display catalog.
Business Catalog: SAP\_CMD\_BC\_BP\_DISP
Master Data - Business Partner Display
| Authorization Object   | Description                                 | Authorization Field   |
|------------------------|---------------------------------------------|-----------------------|
| B_BUPA_GRP             | Authorization Group for Business Part- ners | BEGRU                 |
| B_BUPA_RLT             | Business Partner Role                       | RLTYP                 |
Business Partner Display Catalog Used by Intrastat Apps (POI)
If you assign business catalog SAP\_SLL\_BC\_INTRASTAT\_DECLN in a backend role, you also assign business catalog SAP\_CMD\_BC\_BP\_DISP in the same backend role. If you assign business catalog SAP\_SLL\_BC\_POI\_MANAGE in a backend role, you also assign business catalog SAP\_CMD\_BC\_BP\_DISP in the same backend role. Specify business partner role type B\_BUPA\_RLT with ACTVT = 03 &amp; RLTYP = 'SLLSTL'. 'SLLSTL is the contact person created as provider of information.
## 13.2.3.1.2  International Trade Classification
## Related Information
Manage Authorization for Generic UIs for International Trade Classification [page 82]
Generic UIs - Application Log for International Trade Classification [page 82]
## 13.2.3.1.2.1  Manage Authorization for Generic UIs for International Trade Classification
## Related Information
Generic UIs - Application Log for International Trade Classification [page 82]
Dependent Business Catalog for International Trade Classification [page 83]
## 13.2.3.1.2.1.1  Generic UIs - Application Log for International Trade Classification
## Context
Manual action required.
1. Assign Fiori catalog to PFCG role.
2. Fill authorization data for authorization object S\_APPL\_LOG .
1. Log object -ALG\_OBJECT
2. Log sub-object -ALG\_SUBOBJ
| Business Catalog            | Log Object    | Log Sub-Object                           | Fiori ID                                             |
|-----------------------------|---------------|------------------------------------------|------------------------------------------------------|
| SAP_SLL_BC_CMMDTYCODE_ ACTV | /SAPSLL/CLSMD | /SAPSLL/CNT_ACT_CHK /SAPSLL/CNT_CONS_CHK | F4888 Application Log for Classification Master Data |
| SAP_SLL_BC_CTRLCLASS_A CTV  | /SAPSLL/CLSMD | /SAPSLL/CNT_ACT_CHK /SAPSLL/CNT_CONS_CHK | F4888 Application Log for Classification Master Data |
| Business Catalog       | Log Object    | Log Sub-Object       | Fiori ID                   |
|------------------------|---------------|----------------------|----------------------------|
| SAP_SLL_BC_TRIFNMBR_AC | /SAPSLL/CLSMD | /SAPSLL/CNT_ACT_CHK  | F4888 Application Log for  |
| TV                     |               | /SAPSLL/CNT_CONS_CHK | Classification Master Data |
## 13.2.3.1.2.2  Dependent Business Catalog for International Trade Classification
If you assign business catalog SAP\_SLL\_BC\_CLS\_CMMDTYCODE in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_CLS\_TRIFNMBR in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_CLS\_ISSRVCCODE in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_CLS\_LEGCTRL in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_CLS\_OVERVIEW in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_PROD\_CLS\_DISP in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
## 13.2.3.1.3  International Trade Compliance
## Related Information
Manage Authorization for Generic UIs for International Trade Compliance [page 83] Dependent Business Catalog for International Trade Compliance [page 85]
## 13.2.3.1.3.1  Manage Authorization for Generic UIs for International Trade Compliance
## Related Information
Generic UIs - Attachment for License Master [page 84]
## 13.2.3.1.3.1.1  Generic UIs - Application Job for International Trade Compliance
## Context
Manual action required.
1. Assign Fiori catalog to PFCG role.
2. Assign additional authorization default for required application job catalog entry.
3. Fill authorization field P\_PROGNAM with report name for authorization object S\_PROGNAM .
| Business Catalog            | Application Job Catalog En- try   | Report Name               | Fiori ID                                              |
|-----------------------------|-----------------------------------|---------------------------|-------------------------------------------------------|
| SAP_SLL_BC_COMPLDOC_MA NAGE | SAP_SLL_TCD_RECHECK_MA SS         | /SAPSLL/ TCD_RECHECK_MASS | F4285 Schedule Recheck Documents - Trade Compli- ance |
## 13.2.3.1.3.1.2  Generic UIs - Attachment for License Master
## Context
On the back-end server, you have to assign the OData service authorization to a PFCG role. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Creating Authorization Roles for Catalogs into the search bar, press Enter , and open the search result with that title. In addition, manual actions are required.
## Procedure
1. Assign Fiori catalog SAP\_SLL\_BC\_LICENSE\_MANAGE to PFCG role.
2. Input value for authorization object S\_GOS\_ATT manually:
- BOROBJTYPE = ITRLICMSTR
- ACTIVITY = 02 and
## 13.2.3.1.3.2  Dependent Business Catalog for International Trade Compliance
If you assign business catalog SAP\_SLL\_BC\_LICENSE\_MANAGE in backend role, you also assign business catalog SAP\_CMD\_BC\_BP\_DISP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_LICENSE\_MANAGE in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_CMPLCDOC\_MANAGE in backend role, you also assign business catalog SAP\_SLL\_BC\_LICENSE\_DISP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_LICASSGMT\_DISP in backend role, you also assign business catalog SAP\_CMD\_BC\_BP\_DISP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_LICASSGMT\_DISP in backend role, you also assign business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
## 13.2.3.1.4  Integration
## Related Information
Integration with SAP Global Trade Services [page 85] Integration with SAP Watch List Screening [page 89] Integration with Content Data Provider [page 90]
## 13.2.3.1.4.1  Integration with SAP Global Trade Services
## Related Information
Manage Authorization for Generic UIs for GTS Integration [page 86]
## 13.2.3.1.4.1.1  Manage Authorization for Generic UIs for GTS Integration
## Related Information
Generic UIs - Application Job for Global Trade Services Integration [page 86]
Generic UIs - Application Log for Global Trade Services Integration [page 88]
## 13.2.3.1.4.1.1.2  Generic UIs - Application Log for Global Trade Services Integration
## Context
On the back-end server, you have to assign the OData service authorization to a PFCG role. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Creating Authorization Roles for Catalogs into the search bar, press Enter , and open the search result with that title. In addition, manual actions are required.
1. Assign Fiori catalog to PFCG role.
2. Fill authorization data for authorization object S\_APPL\_LOG .
1. Log Object -ALG\_OBJECT
2. Log Sub Object -ALG\_SUBOBJ
| Business Catalog    | Log Object          | Log Sub Object                                                                                                                                                               | Fiori ID                                                        |
|---------------------|---------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------|
| SAP_SLL_BC_PI_BASIS | /SAPSLL/MD_GTS_DIST | /SAPSLL/CPMAS_DIST /SAPSLL/CREMAS_DIST /SAPSLL/DEBMAS_DIST /SAPSLL/MATMAS_DIST /SAPSLL/BOMMAT_DIST /SAPSLL/PRCMAT_DIST /SAPSLL/PSDMAT_DIST /SAPSLL/CPN_DIST /SAPSLL/SPN_DIST | Application Log for Changed Master Data - Global Trade Services |
## 13.2.3.1.4.1.2  Dependent Business Catalog for SAP Global Trade Services Integration
If you assign business catalog SAP\_SLL\_BC\_PI\_BOM\_TRANS in the backend role, you also assign the business catalog SAP\_PLM\_BC\_MBOM\_DISP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_PI\_BOM\_TRANS in the backend role, you also assign the business catalog SAP\_CMD\_BC\_PRODUCT\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_PI\_CP\_TRANS in the backend role, you also assign the business catalogs SAP\_CMD\_BC\_SUPPLIER\_DSP and SAP\_CMD\_BC\_CUSTOMER\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_PI\_MM\_DOC\_TRANS in the backend role, you also assign the business catalogs SAP\_CMD\_BC\_PRODUCT\_DSP , SAP\_CMD\_BC\_SUPPLIER\_DSP , and SAP\_CMD\_BC\_CUSTOMER\_DSP in the same backend role.
If you assign business catalog SAP\_SLL\_BC\_PI\_PREF\_TRANS in the backend role, you also assign the business catalogs SAP\_SD\_BC\_BIL\_DOC\_DISPL , SAP\_CMD\_BC\_PRODUCT\_DSP , SAP\_CMD\_BC\_SUPPLIER\_DSP , and SAP\_CMD\_BC\_CUSTOMER\_DSP in the same backend role.
## 13.2.3.1.4.2  Integration with SAP Watch List Screening
## Related Information
Manage Authorization for Generic UIs for Screening Integration [page 89]
## 13.2.3.1.4.2.1  Manage Authorization for Generic UIs for Screening Integration
## Related Information
Generic UIs - Application Job for Watch List Screening Integration [page 90]
## 13.2.3.1.4.2.1.1  Generic UIs - Application Job for Watch List Screening Integration
## Context
On the back-end server, you have to assign the OData service authorization to a PFCG role. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Creating Authorization Roles for Catalogs into the search bar, press Enter , and open the search result with that title. In addition, manual actions are required.
1. Assign Fiori catalog to PFCG role.
2. Assign additional authorization default for required application job catalog entry.
3. Fill authorization field P\_PROGNAM with report name for authorization object S\_PROGNAM
| Business Catalog     | Application Job Catalog En- try   | Report Name                 | Fiori ID                                                 |
|----------------------|-----------------------------------|-----------------------------|----------------------------------------------------------|
| SAP_SLL_BC_SCR_BASIS | SAP_SLL_SD0C_DISTRIBUT E_RIMAR3   | /SAPSLL/ WLS_POSTPROCESSING | F3052 Schedule Postpro- cessing - Watch List Screen- ing |
## 13.2.3.1.4.3  Integration with Content Data Provider
## Related Information
Manage Authorizations for Generic UIs for Content Integration [page 90]
## 13.2.3.1.4.3.1  Manage Authorizations for Generic UIs for Content Integration
## Related Information
Generic UIs - Application Job for Content Integration [page 91]
## 13.2.3.1.4.3.1.1  Generic UIs - Application Job for Content Integration
## Context
On the back-end server, you have to assign the OData service authorization to a PFCG role. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Creating Authorization Roles for Catalogs into the search bar, press Enter , and open the search result with that title. In addition, manual actions are required.
1. Assign Fiori catalog to PFCG role.
2. Assign additional authorization default for required application job catalog entry.
3. Fill authorization field P\_PROGNAM with report name for authorization object S\_PROGNAM
| Business Catalog            | Application Job Catalog En- try   | Report Name              | Fiori ID                                                                     |
|-----------------------------|-----------------------------------|--------------------------|------------------------------------------------------------------------------|
| SAP_SLL_BC_CMMDTYCODE_ SCHD | SAP_SLL_CLSCT_COMCO_RE Q          | /SAPSLL/ CLSCT_COMCO_REQ | F3051 Schedule Content Re- quest to Data Provider - Commodity Codes          |
| SAP_SLL_BC_CTRLCLASS_S CHD  | SAP_SLL_CLSCT_CONCL_RE Q          | /SAPSLL/ CLSCT_CONCL_REQ | F3568 Schedule Content Re- quest to Data Provider - Con- trol Classes        |
| SAP_SLL_BC_TRIFNMBR_SC HD   | SAP_SLL_CLSCT_TARNO_RE Q          | /SAPSLL/ CLSCT_TARNO_REQ | F3569 Schedule Content Re- quest to Data Provider - Cus- toms Tariff Numbers |
## 13.2.3.1.5  Deletion of Personal Data in International Trade
International Trade might process data (personal data) that is subject to the data protection laws applicable in specific countries.
##  Note
SAP S/4HANA for international trade does not use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. SAP S/4HANA for international trade uses SAP Business Partner (BP) instead to control the blocking and deletion of personal data.
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for defining the settings for blocking. Choose Customizing, then Cross-Application Components under Data Protection .
## 13.2.3.1.6  Standard Authorization Objects in International Trade
The following table shows the default authorization objects that you need for international trade.
| Authorization Object   | Description                                              |
|------------------------|----------------------------------------------------------|
| ITM_BUKRS              | Authorization for Company Code                           |
| ITM_LGREG              | Authorization for Legal Regulation                       |
| ITM_LMGM               | Authorization for Legal Regulation / License Type        |
| /ECRS/RPHD             | Intrastat Declaration                                    |
| /ECRS/POIA             | Provider of Information                                  |
| /ECRS/SP               | Selection Program for Intrastat Reporting                |
| ITM_CLS_NC             | Trade Classification: Auth. for Numbering Scheme Content |
| ITM_CLS_LR             | Trade Classification: Authorization for Legal Regulation |
| ITM_CLS_NS             | Trade Classification: Authorization for Numbering Scheme |
## 13.2.4  Treasury Management
## 13.2.4.1  SAP Bank Communication Management (incl. SAP Integration Package for SWIFT)
## About this Document
The Security Guide provides an overview of the specific security-relevant information that applies to the SAP Bank Communication Management including the SAP Integration Package for SWIFT .
## 13.2.4.1.1   Technical System Landscape
## Use
SAP Bank Communication Management is responsible for the creation and approval of batches, the payment status monitor and bank statement monitor. Use of the SAP Integration package for SWIFT is optional ; it provides a file interface to the Swift Alliance Access/Alliance Gateway (SWIFT is not SAP software and not part of SAP Bank Communication Management ).
The figure below shows an overview of the technical system landscape for SAP Bank Communication Management .
<!-- image -->
For more information about recommended security zone settings, see ABAP Platform Security Guide .
## 13.2.4.1.2  User Management
## User Types
It is often necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively have to change their passwords on a regular basis, but not those users under which background processing jobs run.
The user types that are required for the SAP Bank Communication Management include:
- Individual users Dialog users are used for SAP GUI for Windows connections.
- Technical users
Communication users are used for XI communication.
## Standard Users
The table below shows the standard users that are necessary for operating the SAP Bank Communication Management .
| System                              | User ID                 | Type               | Password                                                                                                                                | Description                                                                                                              |
|-------------------------------------|-------------------------|--------------------|-----------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
| SAP Bank Communi- cation Management | For example: BRMXIUSER  | Communication user | You specify the initial password during the installation. The user ID and pass- word are stored in the XI channel for the con- nection. |                                                                                                                          |
| XI Integration Server               | For example: SWIFTADMIN | Default user       | You specify the initial password during the installation.                                                                               | Member of user group SWIFT_ADMIN- ISTRATOR as descri- bed in the SAP Integration Package for SWIFT Configuration Guide . |
You need to create these users before XI configuration.
Assign role SAP\_XI\_IS\_SERV\_USER to user BRMXIUSER and role SWIFT\_ADMINSTRATOR to user SWIFTADMIN.
Creation of role SWIFT\_ADMINSTRATOR is described in the SAPIntegration Package for SWIFT Configuration Guide .
## 13.2.4.1.3   Communication Destinations
The table below shows an overview of the communication destinations used by SAP Bank Communication Management .
| Destination        | Delivered   | Type   | User, Authorizations                  |
|--------------------|-------------|--------|---------------------------------------|
| INTEGRATION_SERVER | No          | RFC    | XIAPPLUSER Role SAP_XI_APPL_SERV_USER |
| LCRSAPRFC          | No          | RFC    |                                       |
| SAPSLDAPI          | No          | RFC    |                                       |
These destinations are not application-specific but they are required for the operation of the Exchange Infrastructure.