## 13.13.5.3.3  Investigative Case Management
The technical system landscape of the SAP Investigative Case Management for SAP S/4HANA is based on the technical system landscape of SAP S/4HANA Service. For more information, see Service [page 608].
Investigative Case Management (ICM) delivers all the functionalities as apps in a SAP Fiori Launchpad. This harmonized approach includes Fiori-based applications (location and object) and Web-client UI-based harmonized applications. As a result, application access goes through different technology security layers and is subjected to numerous authorization checks. The following figure provides an overview of the high level different security checkpoints.
<!-- image -->
ICM provides CDS based enterprise search models which enables business users to search across different entities.
## User Administration and Authentication
Investigative Case Management uses the user management and authentication mechanisms provided with the SAP NetWeaver platform, the SAP NetWeaver Application Server ABAP. Therefore, the security recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver Application Server ABAP Security Guide also apply to the Investigative Case Management application.
In the ICM area, SAP delivers the business role Criminal Investigator. It is designed to be used as a template for defining customer-specific roles. The role supplied already contains numerous functions that you can use to access data and information that you require for your daily work. However, other settings are also required for the UI framework and for authorizations. For more information, search for User Interface and Roles in Service solution.
## User Management Tools
The tools for user and role administration with SAP NetWeaver AS ABAP are the transaction SU01 for User Maintenance transaction and the transaction PFCG for profile generation.
For more information, see SAP Library for SAP NetWeaver on SAP Help Portal at ABAP Platform and SAP NetWeaver .
Select the release that is relevant for you and then go to Application Help Function-Oriented View Security Identity Management User and Role Administration of Application Server ABAP Administration of Users and Roles
## User Types
For Investigative Case Management, it is necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively change their passwords on a regular basis, but users who process background jobs do not.
For Investigative Case Management, there are the following types of users:
- Users with the standard Criminal Investigation role
- These users are subject to the authorization objects outlined in the Authorizations section below. The
- authorization model requires that these users be directly associated with the Criminal Investigation PFCG role both in SAP Fiori frontend and backend systems (using the direct authorization role assignment SU01 or PFCG transactions in backend and business role assignment app in the SAP Fiori frontend system).
- Users with an administrative role
- These users are granted universal rights over objects governed by the rules and rights outlined in the Authorizations section below.
For more information about these user types, see the User Types section in the SAP NetWeaver AS ABAP Security Guide .
## Authorizations
Investigative Case Management uses the authorization concept provided by SAP NetWeaver. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply to Investigative Case Management.
For more information, see AS ABAP Authorization Concept in SAP Library for SAP NetWeaver on SAP Help Portal at ABAP Platform and SAP NetWeaver under &lt;Choose relevant release&gt; Security SAP NetWeaver Security Guide Security Guides for SAP NetWeaver Functional Units Security Guides for the Application Server Security Guides for AS ABAP SAP NetWeaver Application Server for ABAP Security Guide .
## Business Function
The following ICM business functions are delivered in Always ON state and no further adjustments are needed to activate any features. All the related switches are also available in Always ON state.
- CRM\_IPS\_ICM\_3
- CRM\_IPS\_ICM\_1
- CRM\_IPS\_ICM\_4\_01
- CRM\_IPS\_ICM\_4\_04
## Authorization Rules
Investigative Case Management includes the following authorization business rules out-of-the-box:
- Security level rule
The security level rule is used to provide a broad level of authorization. The rule grants access rights to users who have a security level for a given Investigative Case Management application entity type that is higher than or equal to the security level of a given instance of the entity type. The security level assignment is done using the security level static authorization objects discussed in the Standard Static Authorization section above.
- Hidden Rule
The hidden rule is a composite rule. This rule revokes access rights from users who typically have access using the security level rule unless the user is assigned as staff and unit.
The standard authority checks cover static and dynamic authority checks across both ICM specific and reused business object related checks.
##  Note
The hidden flag check is in combination with the security level check. When the hidden flag is set, the security level is ignored.
##  Note
The default security level of an entity during its creation is Non-Classified and default hidden feature is Non-Hidden .
## Business Roles
Investigative Case Management (ICM) uses the WebClient UI Framework as embedded in the SAP Fiori Launchpad (FLP) called Integration mode. We recommend checking the default Fiori frontend criminal investigator business role ( SAP\_BR\_INVESTIGATOR ) delivered and copying it as necessary. This role contains preconfigured SAP Fiori Tile Catalogs and Groups. ICM Web UI applications will be accessible using the apps available in the FLP .
##  Note
In the integration mode, ICM applications are embedded in a FLP shell instead of the classical WebClient UI Framework L-shape. Hence, there are no backend WebClient UI business roles or navigation bar profiles delivered or loaded in the FLP .
You need to create a backend PFCG role to control the backend authorizations. A default Fiori Launchpad Catalog ( SAP\_CRM\_BC\_INVESTIGATOR ) is delivered with pre-configured function profiles and target ids. This customization plays a key role in generating backend PFCG role. For more information, see IMG Customizing for Service under UI Framework Technical Role Definition Define Fiori Launchpad Catalogs .
Even though it is technically possible to work with this default criminal investigator business role, we recommend copying this role to create customer-specific business roles.
The following table shows the standard roles that are used and delivered in Investigative Case Management:
| Role                | Description                                                                                                                                                                                                            |
|---------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_BR_INVESTIGATOR | This is a default Fiori frontend criminal investigator business role. This role contains preconfigured SAP Fiori Tile Catalogs and Groups. ICM Web UI applications are accessible using the apps available in the FLP. |
## Standard Authorization Objects
The following table contains all relevant services used in the Investigation Case Management. The authorization to start a service must be inserted in the appropriate PFCG role menu.
| Service                                                                  | Type             |
|--------------------------------------------------------------------------|------------------|
| /IWPGW/TASKPROCESSING                                                    | OData Service    |
| CV_ATTACHMENT_SRV                                                        | OData Service    |
| C_ICM_LOCATIONTP_CDS_SRV                                                 | OData Service    |
| C_ICM_OBJECTTP_CDS_SRV                                                   | OData Service    |
| UIU_COMP_BP_EMPL_MAIN_MainWindow_SEARCH                                  | External Service |
| UIU_COMP_CRM_CALENDAR_MainWindow_OVERVIEW                                | External Service |
| UIU_COMP_ICM_BP_MAIN_ICM_BP_MAIN/ MainWindow_SEARCH                      | External Service |
| UIU_COMP_CRM_ICM_CMG_MainWindow_SEARCH_CASE                              | External Service |
| UIU_COMP_CRM_ICM_ACT_FR_CRM_ICM_ACT_FR/ MainWindow_SEARCH_EMAIL          | External Service |
| UIU_COMP_CRM_ICM_ACT_FR_CRM_ICM_ACT_FR/ MainWindow_SEARCH_INCIDENT       | External Service |
| UIU_COMP_CRM_ICM_CMG_MainWindow_SEARCH_LEAD                              | External Service |
| UIU_COMP_CRM_ICM_ACT_FR_CRM_ICM_ACT_FR/ MainWindow_SEARCH_OPERATION      | External Service |
| UIU_COMP_CRM_ICM_ACT_FR_CRM_ICM_ACT_FR/ MainWindow_SEARCH_OPERATION_TMPL | External Service |
| Service                                                           | Type             |
|-------------------------------------------------------------------|------------------|
| UIU_COMP_ICM_BPPROF_ICM_BPPROF/ CategoriesWindow_FROMNAVBAR       | External Service |
| UIU_COMP_ICM_EXTERN_MAIN_ICM_EXTERN_MAIN/ MainWindow_EXTERNAL_SRC | External Service |
| UIU_COMP_ICM_WLI_ICM_WLI/MainWindow_DEFAULT                       | External Service |
| UIU_COMP_MDOMM_ORGDATA_MainWindow_SEARCH                          | External Service |
| UIU_COMP_WCF_MIXED_LIST_WCF_MIXED_LIST/ MainWindow_DEFAULT        | External Service |
## ICM Authorization Objects
The table below shows the authorization objects that are especially used by Investigative Case Management.
Values for common field ICM\_SECLVL can be customized in the IMG under Service Industry-Specific Solutions Public Sector Investigative Case Management General Settings Authorizations Define Security Levels (with the domain value ICM ).
Values for field ICM\_RELTYP are defined in the IMG under Service Industry-Specific Solutions Public Sector Investigative Case Management General Settings Relationships Define Relationship Types
For technical reasons, every user must have authorization for type S900 and S901 .
| Authorization   | Field      | Value                                      | Description                                                                                                                                                                                                                                                                                                                  |
|-----------------|------------|--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CRM_ICMADM      | ACTVT      | W1 W2                                      | Each value specifies a partic- ular authorization for an ac- tivity. W1 grants the author- ization to add and remove partners from the Staff& Units assignment block of the Investigative Case Man- agement case entity.W2 grants the right to toggle the hidden flag for all Investiga- tive Case Management case entities. |
| CRM_ICMCAS      | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this object de- fines the security level for a case type. For example, the                                                                                                                                                                                                                                    |
| Authorization   | Field      | Value                                      | Description                                                                                                                                                                                                                                           |
|-----------------|------------|--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                 | ICM_CASTYP | Available case type for ICM                | combination ICM_SECLVL = 50 and ICM_CASTYP = ICMC grants the user or owner of the static authoriza- tion object instance access to all cases of the type ICM with a security level of 50.                                                             |
| CRM_ICMLEA      | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this object de- fines the security level for a lead type. For example, the combination ICM_SECLVL                                                                                                                                      |
|                 | ICM_LEATYP | Available lead type for ICM                | = 50 and ICM_LEATYP = ICML grants the user or owner of the static authoriza- tion object instance access to all leads of type ICML with a security level up to 50.                                                                                    |
| CRM_ICMOPE      | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this object defines the security level for an investigative activ-                                                                                                                                                                     |
|                 | ICM_OPETYP | Available activity categories for ICM      | ity type. For example, the combination ICM_SECLVL = 50 and I CM_OPETYP = OPR grants the user or owner of the static authorization object instance access to all investigative activities of ac- tivity category OPR with a se- curity level up to 50. |
| CRM_ICMINC      | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this object defines the security level                                                                                                                                                                                                 |
|                 | ICM_INCTYP | Available categories for ICM               | for an incident type. For example, the combination ICM_SECLVL = 50 and ICM_INCTYP = INC grants the user or owner of the static authorization ob- ject instance access to all in- cidents of activity category INC with a security level up to 50.     |
| Authorization   | Field      | Value                                      | Description                                                                                                                                                                                                                                                       |
|-----------------|------------|--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CRM_ICMLOC      | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this object defines the security level for locations/ objects. For example, the combination ICM_SECLVL = 50 grants the user or owner of the static authorization object instance access to all loca- tions/objects with a security level up to 50. |
| CRM_ICMEMA      | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this object de- fines the security level for e- mails. For example, the com- bination I ICM_SECLVL = 50 grants the user or owner of the static authorization object instance access to all e-mails with a security level up to 50.                 |
| CRM_ICMREL      | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this object defines the security level for a relationship type. For                                                                                                                                                                                |
|                 | ICM_RELTYP | Available relationship type for ICM        | example, the combination ICM_SECLVL = 50 and ICM_RELTYP = Z001 grants the user or owner of the static authorization ob- ject instance access to all re- lationships of type Z001 with a security level up to 50.                                                  |
| CRM_ICMBP       | ICM_SECLVL | Allowed customized security levels for ICM | An instance of this ob- ject defines the security level for business partners. For example, the setting ICM_SECLVL = 50 grants the user or owner of the static authorization object in- stance access all business partners with a security level up to 50.       |
| Authorization   | Field      | Value                                                                                                | Description                                                                                                                                                                            |
|-----------------|------------|------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CRM_ICMBPP      | ICM_SECLVL | Allowed customized security levels for ICM                                                           | An instance of this ob- ject defines the security level for business partners. For example, the setting ICM_SECLVL = 50 grants a security level of 50 for busi- ness partner profiles. |
| CRM_ICMRLA      | ACTVT      | Allowed customized ACTVT entries: 1 Create 2 Change 3 Display W3Edit Expunge Date                    | This object is used to deter- mine what activities can be performed on a relationship.                                                                                                 |
| CRM_ICMEXP      | ACTVT      | Allowed customized ACTVT entries: 01 Create or Generate 02 Change 03 Display 06 Delete               | This object is used to pro- vide users access to the ex- punged data.                                                                                                                  |
| ICMS4_OBJ       | ACTVT      | Allowed customized ACTVT entries: 01 Add or Create 02 Change 03 Display 06 Delete 56 Display archive | This object is used to provide access to ICM object.                                                                                                                                   |
| Authorization   | Field   | Value                                                                                                                         | Description                                            |
|-----------------|---------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------|
| ICMS4_LOC       | ACTVT   | Allowed customized ACTVT entries: 01 Add or Create 02 Change 03 Display 06 Delete 56 Display archive F4 Display in value help | This object is used to provide access to ICM location. |
## Data Access Related Authorization Objects
Besides ICM specific authorization objects some data access related authorization objects are required and explicitly checked during operations in ICM. To use the complete functionality of ICM these objects must be considered. The table below lists the important authorization objects of this category.
| Authorization   | Description                                               |
|-----------------|-----------------------------------------------------------|
| B_BUPA_ADR      | Business Partner: BP Addresses                            |
| B_BUPA_ADR      | Business Partner: Authorization Groups                    |
| B_BUPA_GRP      | Business Partner: Authorization Groups                    |
| B_BUPA_RLT      | Business Partner: BP Roles                                |
| B_BUPR_BZT      | Business Partner Relationships: Relationship Categories   |
| B_CCARD         | Payment Cards                                             |
| B_USERSTAT      | Status Management: Set/Delete User Status                 |
| CRM_BP_ASS      | Authorization for Rule Based Assignment                   |
| CRM_BPROLE      | Business Partner in Service: BP Roles                     |
| CRM_CATEGO      | Authorization Object for Coherent Categorization          |
| CRM_CO_SE       | Authorization Object CRMOrder - Bus. Ob. Service Contract |
| CRM_ORD_LP      | Authorization Object CRMOrder - Visibility in Org. Model  |
| CRM_ORD_OP      | Authorization Object CRMOrder - OwnDocuments              |
| Authorization   | Description                                                 |
|-----------------|-------------------------------------------------------------|
| CRM_ORD_PR      | Authorization Object CRMOrder - Business Transaction Type   |
| CRM_TXT_ID      | CRM: Text ID                                                |
| CRMS4_SLSO      | Sales Organizational Units of Service Transactions          |
| F_KNA1_APP      | Customer: Application Authorization                         |
| F_KNA1_BED      | Customer: Account Authorization                             |
| F_KNA1_GEN      | Customer: Central Data                                      |
| F_KNA1_GRP      | Customer: Account Group Authorization                       |
| F_LFA1_APP      | Vendor: Application Authorization                           |
| F_LFA1_BEK      | Vendor: Account Authorization                               |
| F_LFA1_BUK      | Vendor: Authorization for Company Codes                     |
| F_LFA1_GEN      | Vendor: Central Data                                        |
| F_LFA1_GRP      | Vendor: Account Group Authorization                         |
| I_EQTYP         | Equipment Category                                          |
| M_LFM1_EKO      | Purchasing Organization in Supplier Master Record           |
| M_MATE_MAR      | Material Master: Material Types                             |
| M_MATE_MAT      | Material Master: Materials                                  |
| M_MATE_WGR      | Material Master: Material Groups                            |
| P_ORGIN         | HR: Master Data                                             |
| P_PERNR         | HR: Master Data - Personnel Number Check                    |
| PLOG            | Personnel Planning                                          |
| PS_RMPSOEH      | RMPS: Access Record, Case, Document Special Org. Units      |
| PS_RMPSORG      | RMPS: Access Record, Case, Document Org. Assignment of User |
| PS_RMPSPGE      | RMPSTNA: Enhanced Check on Activities                       |
| PS_RMPSPSP      | RMPSTNA: Status-Dependent Attribute Check                   |
| S_SCMG_CAS      | Case Management: Case                                       |
| Authorization   | Description                                                    |
|-----------------|----------------------------------------------------------------|
| S_SCMG_FLN      | Case Management: Authorization by Field                        |
| S_SCMG_STA      | Case Management: Status                                        |
| S_SCMG_TXT      | Case Management: Text Notes                                    |
| S_SERVICE       | Check at Start of External Services                            |
| S_SRMGS_CT      | Records Management: Authorizations for Document Con- tent      |
| S_SRMGS_DC      | Records Management: Authorization for Documents                |
| S_SRMGS_PR      | Records Management: Authorizations for Attributes              |
| S_SRMGS_VV      | Records Management: Authorizations for Versions and Var- iants |
| S_SRMRECST      | Records Management: Record: Authorizations for Record Strctr   |
| S_SRMSY_CL      | SAP Records Management : General Authorization Object          |
| S_SRM_STAT      | SRMStatus Management: General Authorization Object             |
| S_SRM_ST_P      | SRMStatus Management: Auth. Object for Status Profile          |
| UIU_COMP        | CRMUIUComponent                                                |
| V_KNA1_VKO      | Customer: Authorization for Sales Organizations                |
## Other Security-Relevant Information
The standard settings in SAP S/4HANA Service allow users to search for all business partners. To limit your searches to persons and organizations in Investigative Case Management from the standard objects, see Customizing for Service under Industry-Specific Solutions Public Sector Investigative Case Management Persons and Organizations Exclude ICM Persons and Organizations from Account and Contact Search .
## Data Protection and Privacy
ICM provides specific features and functions to support compliance with the relevant legal requirements and data protection and privacy.
## Logging and Monitoring
ICM is mainly used by law-enforcement authorities, therefore logging and monitoring access to sensitive data is required by law in order to fulfil legal compliance. Following are the tools you can consider for fulfilling the logging and monitoring requirements:
## · Read Access Logging
SAP delivers sample configurations for applications for ICM through SAP Note 2739669. Investigative Case Management logs data of ICM person including the person search and results. It also logs data of ICM person that are displayed on the case, lead, activity, incident, object and locations overview pages.
For more information about RAL, see the Product Assistance for SAP S/4HANA on SAP Help Portal at SAP S/4HANA under Product Assistance Industries Public Services Public Sector Investigative Case Management Authorization and Security in ICM Data Protection Read Access Logging in ICM . You can access the list of logged fields in the following delivered default configurations:
| Configuration            | Channel     | Business Context                                              |
|--------------------------|-------------|---------------------------------------------------------------|
| SAP_ICM_PERSON_DETAILS   | Web UI      | Data access log for the ICM person in Web UI                  |
| C_ICM_LOCATIONTP_CDS_SRV | SAP gateway | Data access log for person details in the ICM location entity |
| C_ICM_OBJECTTP_CDS_SRV   | SAP gateway | Data access log for person details in the ICM object entity   |
## · Work load analysis for ICM
SAP workload analysis (transaction STAD ) plays a vital role during security audits. Auditors often use this transaction to intersect any possible unauthorized system access.
ICM provides a refined flavor of transaction STAD in a wrapper transaction called STAD\_ICM . This aims at assisting auditors to provide flexible selection screens. Filter parameters like User , Transaction and Report support multiple value filters compared to its predecessor transaction. A default variant DEFAULT\_ICM demonstrates auditors to arrive at a positive list of un-authorized access in an ICM system context to readily act upon.
## · ICM Critical Authorizations for User Information System
SAP User Information System (transaction SUIM ) summarizes many different SAP authorization aspects in one place.
For more information, see User Information System on SAP Help Portal at User and Role Administration of Application Server ABAP .
## User Information System analysis for ICM
To detect critical authorizations assigned to a user via a PFCG role, a variant in the SAP User Information System (transaction SUIM ) is created. The variant of the SUIM report 'Users or Roles with Combinations of Critical Authorizations' (RSUSR008\_009\_NEW) contains critical authorization objects which should not be accessible for users in the ICM. Therefore, the SUIM variant allows to scan PFCG roles for the corresponding authorization objects.
As the SUIM variant is based on the SAP standard authorization objects, it must be used as a reference and adjusted for customer specific objects.
Following are the steps to access the SUIM variant in the ABAP system:
1. Use transaction SUIM and execute the following path:
User Information System User With Critical Authorizations
2. On the selection screen; choose the option For Critical Authorizations , select the variant SAPICM and execute again.
For more information on how to use and how to create or adapt SUIM variants for 'Users or Roles with Combinations of Critical Authorizations' , see the program documentation (SHIFT F1) which you can find after starting the SUIM function.
## · Auditing in SAP HANA systems
Auditing at HANA provides you with visibility on who did what in the database (or tried to do what) and when. This allows you, for example, to log and monitor read access to sensitive data. For more information, see Auditing Activity in SAP HANA Systems in Security Guide for SAP HANA
Platform on SAP Help Portal at SAP HANA Platform .
## Information Retrieval
ICM supports information retrieval using SAP NetWeaver component Information Retrieval Framework (IRF). For more technical details, refer to SAP note 2815160.
The following IRF models allow retrieval of ICM entity data with reference to an ICM person.
##  Note
The IRF entry point for each of the delivered models is an ICM person ID (business partner ID).
| Model Name            | ICM Entity Name                             |
|-----------------------|---------------------------------------------|
| CA_BUPA               | ICM Person and ICM Relationships            |
| CRMS4_ICML/CRMS4_ICMB | ICM Location/Object and ICM Relationships   |
| CRM_ACT_ON            | ICM Activity/Incident and ICM Relationships |
| SCMG                  | ICM Case/Lead and ICM Relationships         |
##  Note
Attachments or URLs of the attachments are not part of the above IRF models. Only the metadata of the attachments are available. Administrators can download the attachments by navigating to the corresponding overview pages. The navigation path to download the attachments is as follows:
Open the app (Manage Persons and Organizations app for Person entity, Manage Cases app for case entity and so on) Go to the overview page Go to Attachments assignment block Select the attachments to download Choose Download .
For more information about system configuration, see Setting Up the System for the IRF on SAP Help Portal at Information Retrieval Framework (IRF) .
##  Note
Relationship data between a person and any other entity is read with the precondition that the ICM entity person is a source, in the entity links between relationship types. You must ensure this while setting up entity links for any custom relationship types in the Customizing for Service under Industry-Specific SolutionsInvestigative Case Management .
For more information about information retrieval, see the product assistance for SAP S/4HANA on SAP Help Portal under Product Assistance Industries Public Services Public Sector Investigative Case Management Authorization and Security in ICM Data Protection Information Retrieval .
## Archiving, Blocking and Deletion
ICM supports Information Life Cycle (ILM) based archiving, blocking and deletion features for all its entities including relationship data. Additionally, ICM provides specialized features called anonymizing person data and expunging of the relationships to control the lifecycle of data.
##  Note
Expunging functionality also deletes person data for outdated expunged relationships.
ICM-related EoP (End of Purpose) checks are made during the BP blocking process. A new application name ICM along with a standard function module CRMS4\_ICM\_BP\_BLOCKING has been registered to perform the check. This prevents ICM data from being accidentally blocked or deleted.
##  Note
During blocking (Transaction BUPA\_PRE\_EOP ), the Check all applications for EoP parameter must be marked X to enable invoking of the above check.
For more information about archiving ICM entities, blocking and deletion, see the product assistance for SAP S/4HANA on SAP Help Portal under Product Assistance Industries Public Services Public Sector Investigative Case Management Authorization and Security in ICM Data Protection
## Archiving of Attachments:
ICM supports Information Life Cycle (ILM) based archiving of documents (DMS based) which are attached to all ICM entities.
The archiving process of SAP Document Management System (DMS) uses the concept of rule inheritance in ILM. The highest retention period of the business object (ICM entity) linked are inherited to the DMS based document. Once the archiving of ICM entity is executed, it also sets the deletion flag for the DMS based documents linked.