orkungedik/SAP-basis-dataset huggingface dataset:
## 13.13.5.1.1.1.4  Reference to Reused Functions
This chapter lists the functions that have been integrated with Defense &amp; Security or are reused by it. It provides you with information about the security-related aspects of these additional components.
## Enterprise Portfolio and Project Management
Enterprise Portfolio and Project Management is integrated with the defense-specific capability business object. For more security-relevant information, see the chapter Enterprise Portfolio and Project Management [page 543].
## Attachments
SAP Defense &amp; Security allows the user to upload files as attachment, for example for the force element and capabilities business objects. Since attachments can potentially contain viruses, these viruses could enter your system when you upload the attachments. To reduce this risk as much as possible, we recommend you use an external virus scanner and restrict the MIME types for the attachments.
For more security-relevant information, see the chapter Virus Scanning [page 24].
## Access to Attachments Using Microsoft Internet Explorer
You are using Microsoft Internet Explorer and want to display attachments in the browser. To do this, Microsoft Internet Explorer checks the content of the attachment to determine the file type and display the attachment correctly (MIME type sniffing). In the worst case, it is therefore possible that harmful files with an undesired
file type are displayed in the browser or might cause other damage. To avoid this potential threat to security, deselect MIME type sniffing in the security settings for Microsoft Internet Explorer.
## Classification
The classification Reuse UI component is integrated with the defense-specific force element, capabilities and mission essential tasks business objects. For more security-relevant information, see the chapter Integrated Product Development for Discrete Industries [page 574].
## Status
Status management is implemented using SAP general status management for the flexible material planning object, capabilities and mission essential tasks business objects. The status framework allows you to define your own status values. The authority objects B\_USERSTAT and B\_USERST\_T can be used to handle the authority of the user and system status.
## 13.13.5.1.1.1.5  Reference to Data Control Language
Defense customers normally use a wide range of ECC / S/4HANA functions. At the same time, these customers often require more specialized authorization checks. To allow for this in a CDS-enabled environment, please check the data control language (DCL) customer extensibility functionality that is now available.
## 13.13.5.1.1.2  Data Protection
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different countries.
## 13.13.5.1.1.3  Change Logs
Users do not see the change log views in the default delivery of Defense &amp; Security due to data protection reasons.
All defense objects use change logs as a default. However, you cannot see an integrated view of the change logs in the Fiori apps for Defense, and must instead retrieve and view these change logs externally. Customers must ensure that sufficient authorization and access restrictions (for example those that apply to viewing personal data changes) are in place if such a provision is available for users.
The change document objects created are shown below.
| Change Document   | Business Context                               |
|-------------------|------------------------------------------------|
| DFS_CO_CHGDOC     | Change logging for the capability object       |
| DFS_MET_CHGDOC    | Change logging for METL                        |
| DFS_STAT_CHGDOC   | Change logging for the capability statement    |
| DFS_ASSGMT        | Change logging for the DFS assignment          |
| DFS_SCN_CHGDOC    | Change logging for the defense scenario        |
| DFS_MODEL         | Change logging for the defense modeling canvas |
| DFS_FE_MEASURES   | Change logging for manage measures             |
| DFS_PLC_CHGDOC    | Change logging for the platform code           |
| DFS_ALLWNC        | Change logging for the defense allowance       |
| DFS_FMPO_CHGDOC   | Change logging forFMPO                         |
| DFS_RELOCATION    | Change logging for Defense relocation planning |
The existing HR change document objects are used for force element and reference force element objects, since the backend APIs are reused in the Fiori app transactions.
## 13.13.5.2  Higher Education and Research
## 13.13.5.2.3  Data Storage Security
## Data Storage
The data for the application are saved in the database tables. Only the data for academic structure can come from a file system, the security aspects of which is described in the next section. There is structural authorization and role based authorization to control access to these data. For more information, see Authorizations.
## Using Logical Path and File Names to Protect Access to the File System
The SAP Student Lifecycle Management applications save data in files in the file system. Therefore, provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The following lists show the logical file names and paths used by the Student Lifecycle Management application and for which programs these file names and paths apply:
## Logical File Names Used
The following logical file names have been created in order to enable the validation of physical file names:
- ISHER\_WEBCATALOGXML
- Programs using this logical file name and parameters used in this context:
- ◦ RHIQ\_XML\_ACADSTRUC (XML Files of Academic Structure)
## Logical Path Names Used
The logical file names listed above all use the logical file path ISHER\_WEBCATALOG.
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). To find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log.
For more information, see about data storage security, see the respective chapter in the ABAP Platform Security Guide.
## 13.13.5.2.4  Read Access Logging (Industry Applications)
## Use
In Read Access Logging (RAL), you can configure which read-access information to log and under which conditions.
Read access to personal data is partially based on legislation, and it is subject to logging functionality. The Read Access Logging (RAL) component can be used to monitor and log read access to data and provide information such as which business users accessed personal data (for example, fields related to bank account data), and when they did so. In RAL, you can configure which read-access information to log and under which conditions. SAP delivers sample configurations for applications. For more information, see the applicationspecific chapters of the Security Guide.
You can display the configurations in the system by performing the following steps:
1. In transaction SRALMANAGER , on the Administration tab page, choose Configuration .
2. Choose the desired channel, for example, WebDynpro.
3. Choose Search.
The system displays the available configurations for the selected channel.
4. Choose Display Configuration for detailed information on the configuration. For specific channels, related recordings can also be displayed.
## Prerequisites
Before you can use the delivered RAL configurations, the following prerequisites are met:
- You are using:
- SAP NetWeaver 7.1 SP0
- AS ABAP 7.51
- Kernel 7.45 SP21 and above
- SAP\_UI 7.51 (UI5 1.40)
- The RAL configurations have been activated.
- You have enabled RAL in each system client.
## More Information
For general information on Read Access Logging, go to https:/ /help.sap.com/s4hana\_op\_2021, open the product assistance, and navigate to Cross Components Data Protection Security Safeguards Regarding Data Protection Read Access Logging (RAL) .
## 13.13.5.2.5  Read Access Logging for Admission Portal
## Use
Read access to personal data is partially based on legislation, and it is subject to logging functionality. The Read Access Logging (RAL) component can be used to monitor and log read access to data and provide information such as which business users accessed personal data (for example, fields related to bank account data), and when they did so.
In RAL, you can configure which read-access information to log and under which conditions.
SAP delivers sample configurations for applications. For more information, see the application-specific chapters of the Security Guide
You can display the configurations in the system by performing the following steps:
1. In transaction SRALMANAGER, on the Administration tab page, choose Configuration .
2. Choose the desired channel, for example, OData service.
3. Choose Search . The system displays the available configurations for the selected channel.
4. Choose Display Configuration for detailed information on the configuration. For specific channels, related recordings can also be displayed.
##  Note
For a list of the delivered log domains, see the product assistance at SAP Help Portal under https:/ / help.sap.com/s4hana\_op\_2021 Product Documentation Security Guide SAP S/4HANA Industries Higher Education and Research Data Protection
## Prerequisites
Before you can use the delivered RAL configurations, the following prerequisites are met:
- You are using:
- SAP NetWeaver 751 SP0
- AS ABAP 7.51
- Kernel 7.45 SP21 and above
- SAP\_UI 7.51 (UI5 1.40)
- The RAL configurations have been activated.
- You have enabled RAL in each system client.
## More Information
For general information on Read Access Logging, go to https:/ /help.sap.com/s4hana\_op\_2021, open the product assistance, and navigate to Cross Components Data Protection Security Safeguards Regarding Data Protection Read Access Logging (RAL) .
For up-to-date information on the delivered RAL configurations, see SAPNote 2347271 .
## 13.13.5.2.6  Specific Read Access Log Configurations
In Read Access Logging (RAL), you can configure which read-access information to log and the conditions. SAP delivers sample configurations for applications. In order to use these configurations, save the ZIP attachments from the following SAP Notes:
2375056 - Read Access Logging content for application Student Life Cycle Management (SLCM)
Extract these ZIP files, and import the RAL configurations using the Import function for configurations using transaction SRALMANAGER . The Student Lifecycle management (SLCM ) Application , IS-HER-CM , Student master data ( PIQSTM ) logs data in order to save the Students master data and also personal data . You can find the configurations as described in the Read Access Logging chapter. In the following configurations, fields are logged in combination with additional fields, in the following business contexts:
| Configuration     | Fields Logged                                                                                           | Business Context                                                                                                                                                                                                                                                                                            |
|-------------------|---------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SLCM_REC_RAL_STMD | Student Number Ethnic Origin / Reli- gion Student Disability / Challenge / Health Student Social Status | The Student Social and Health and Eth- nic data is stored as master data in SAP SLCMApplication. This data is used in calculation of Grants and Fee depending on the various parameters. The Same transaction is used to store multiple academic data and in few of the tabs these personal data is shown . |
## 13.13.5.2.7  Specific Read Access Log Configurations for Admission Portal
In Read Access Logging (RAL), you can configure which read-access information to log and the conditions. SAP delivers sample configurations for applications. In order to use these configurations, save the ZIP attachments from the following SAP Notes:
2601072 - Read Access Logging content for application Student Life Cycle Management (SLCM)
Extract these ZIP files, and import the RAL configurations using the Import function for configurations using transaction SRALMANAGER .
The Admission Portal logs data in order to capture the data from the admission application forms (form runtime) and my request applications. You can find the configurations as described in the Read Access Logging chapter.
In the following configurations, fields are logged in combination with additional fields, in the following business contexts:
| Configuration   | Fields Logged                       | Business Context                                                          |
|-----------------|-------------------------------------|---------------------------------------------------------------------------|
| GFD_CONFIG_SRV  | GFD_FormSubmission:CONTENT          | To capture the standard fields data which comes in JSON format            |
| GFD_CONFIG_SRV  | GFD_FormSubmission:CUSTOM_CON- TENT | To capture the custom content fields data which also comes in JSON format |
## 13.13.5.2.8  Consent Administration
Student Lifecycle Management captures the consent management questions in the preliminary questionnaire. The information entered in the fields of the questioniare is only stored when the user has opted Yes for consent management question. When the user clicks Apply , the BAdi BADI\_GFD\_FORM\_REDIRECT checks this logic and saves the data. In case the user selects No for the consent management question an error message must be created by you to return without saving the data.
##  Recommendation
You can implement the BAdI BADI\_GFD\_ERROR\_INFO for further processing like Saving or Declining .
In My Request application, you must handle this saving or rejecting of data in the error handling BAdi BADI\_GFD\_ERROR\_INFO .
Following are some of the important consent management questions:
| Attribute Name                | Data Type   | Length   | Description                          | Mandotory   | Important   |
|-------------------------------|-------------|----------|--------------------------------------|-------------|-------------|
| JURISDICTION                  | CHAR        | 3        | Jurisdiction                         | X           |             |
| VALID_FROM                    | DEC         | 21,7     | Consent's Valid From Point in Time   | X           |             |
| VALID_TO                      | DEC         | 21,7     | Consent's Valid To Point in Time     | X           |             |
| EXPIRING_DATE                 | DEC         | 21,7     | Expiring Date                        |             |             |
| GRANTED_AT                    | DEC         | 21,7     | Granted At                           |             | X           |
| GRANTED_BY                    | CHAR        | 128      | Granted By User                      |             | X           |
| WITHDRAWN_AT                  | DEC         | 21,7     | Point in time Con- sent is withdrawn |             | X           |
| WITHDRAWN_BY                  | CHAR        | 128      | User who withdraw the Consent        |             | X           |
| LANGUAGE                      | LANG        | 1        | Language                             | X           |             |
| CNSNT_QSTN_TE XT              | STRING      | -        | Consent Text                         | X           |             |
| PURPOSE_NAME                  | CHAR        | 30       | PurposeName                          | X           |             |
| PURPOSE_DE- SCRIPTION         | CHAR        | 80       | Purpose Descrip- tion                |             |             |
| PURPOSE_SENSI- TIVE_PERS_DATA | CHAR        | 1        | Purpose Sensitive Data               | X           |             |
| APPLICA- TION_NAME            | CHAR        | 30       | ApplicationName                      |             | X           |
| APPLICATION_DE- SCRIPTION     | CHAR        | 80       | Application De- scription            |             |             |
## 13.13.5.3  Public Sector
## 13.13.5.3.1  Public Sector Management
Data Storage
## Using Logical Paths and File Names to Protect Access to the File System
Public Sector Management stores data in files in the file system. For this reason, it is important to be able to grant access to the files in the file system explicitly without granting access to other folders or files (also known as folder traversals). Y ou do this in the system by entering logical paths and file names that are assigned to the physical paths and file names. This assignment is validated during runtime, whereby an error message is issued whenever a user tries to access a folder that does not correspond to a stored assignment.
The following lists provide an overview of the logical file names and paths that are used by Public Sector Management and of the programs for which these file names and paths are valid:
## Logical File Names Used in Public Sector Management
The logical file name PSM\_EXECUTION\_DATA\_EXPORT has been created to enable the validation of physical file names.
The program RFEXBLK0 uses this logical file name.
## Logical Path Names Used in Public Sector Management
The above-mentioned logical file name uses the logical file path PSM\_ROOT.
## Activating the Validation of Logical Paths and File Names
These logical paths and file names are entered in the system for the corresponding programs. For reasons of downward compatibility, validation is deactivated by default during runtime. To activate validation during runtime, define the physical path using transactions FILE (across all clients) and SF01 (client-specific). To determine which paths are used by your system, you can activate the relevant settings in the Security Audit Log.
## 13.13.5.3.1.1.1  Deletion of Personal Data in Funds Management
Funds management may process data subject to the data protection laws applicable in specific countries as described in SAP Note 1825544 .
## End of Purpose Check
An EoP check determines whether data are relevant for business activities based on the retention period defined for the data.
For information about the configuration settings required to enable this three-phase based EoP check, see Process Flow and Configuration: Simplified Blocking and Deletion .
## Relevant Application Objects and Available Deletion Functionality
Funds Management uses SAP ILM to support the deletion of personal data. For more information, see the documentation for SAP Information Lifecycle Management .
| Archiving Object   | Description                     |
|--------------------|---------------------------------|
| FM_BUDENT          | Budget entry documents          |
| FM_BUDHIE          | Budget hierarchy documents      |
| FM_BUDSUM          | Budget totals                   |
| FM_DOC_CO          | COpostings                      |
| FM_ACTSUM          | Commitments and actuals totals  |
| FM_DOC_OI          | Commitments and funds transfers |
| FM_FUNRES          | Earmarked funds                 |
| FM_DOC_FI          | FI postings                     |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection .
## Run Deletion Programs
We recommend scheduling regular jobs to run the deletion programs using the Define Background Job .
## 13.13.5.3.1.2  Grants Management
## Standard roles for Grants Management (PSM-GM)
| Function                  | Name                               | Function                                                                      |
|---------------------------|------------------------------------|-------------------------------------------------------------------------------|
| SAP_FI_GM_GRANT_ANALYST   | Grants Management: Grant Analyst   | Master data maintenance, execution of reports                                 |
| SAP_FI_GM_GRANT_MANAGER   | Grants Management: Grant Manager   | New entry, check, and approval of mas- ter data, execution of billing program |
| SAP_FI_GM_PROGRAM_ANALYST | Grants Management: Program Analyst | Creation of master data, processing of proposals and budget                   |
| SAP_FI_GM_PROGRAM_MANAGER | Grants Management: Program Manager | Check and approval of proposals and budget                                    |
| Function                  | Name                               | Function                                                |
|---------------------------|------------------------------------|---------------------------------------------------------|
| SAP_FI_GM_PROJECT_MANAGER | Grants Management: Project Manager | Management of grants and budget, exe- cution of reports |
## Authorization Objects for Grants Management (PSM-GM)
| Authorization Object   | Name                                      |
|------------------------|-------------------------------------------|
| F_FIGM_BUD             | Grants Management: Authority for Budget   |
| F_FIGM_CLS             | Grants Management: Authority for Class    |
| F_FIGM_GNG             | GM: Grant Groups                          |
| F_FIGM_GNT             | Grants Management: Authority for Grant    |
| F_FIGM_PRG             | Grants Management: Authority for Programs |
| F_FIGM_SCG             | GM: Sponsored Class Groups                |
| F_FIGM_SPG             | GM: Sponsored Program Groups              |
The master data objects and business processes of Grants Management are protected by standard authorization objects.
US Federal Government uses the authorization concepts of the components that it deploys, such as Funds Management and Material Management. See also the documentation for Funds Management on https:/ / help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Finance Public Sector Management Funds Management Authorizations .
You can use the following BAdI to implement enhancements to the authorization concept:
| BAdI               | Name                                           |
|--------------------|------------------------------------------------|
| GM_AUTHORITY_CHECK | Grants Management: Authorization Check         |
| GM_BILL_AUTHORITY  | GM: User Authorization for DP90 inGM           |
| GM_POST_AUTHORITY  | Grants Management Coding Block Authority Check |
## 13.13.5.3.1.3  Network and Communication Security
Public Sector Management communicates with:
- Human Capital Management (HCM) as part of the scenario Position Budgeting and Control
- Customer Relationship Management (CRM) as part of the scenario Grantor Management
The communication with these internal SAP components takes place per Remote Function Call (RFC). See the corresponding sections in the RFC/ICF Security Guide .
The US Federal Government has both payment and collection outbound interfaces at its disposal for Treasury Confirmation and Intragovernment Payment and Collections (IPAC). This outbound interface uses payment methods and flat files.
The inbound interface of the Central Contractor Registration (CCR) uses IDocs .
For registering portal users in the backend system, we recommend that the user is assigned in both the portal and the backend system. In other words, the user ID of a user in the portal and the backend system should match.
## 13.13.5.3.1.4  More Security Information
Authorization checks only take place in Public Sector Management and Funds Management when the authorization group of a master data object is entered. To ensure that an adequate check is carried out, SAP recommends that you define the affected fields as required entry fields in the field status control. You define this setting in Customizing for Public Sector Management :
- Funds Management-Specific Postings Earmarked Funds and Funds Transfers Field Control for Earmarked Funds and Funds Transfers Define Field Status Variant / Assign Field Status Variant to Company Code / Define Field Status Groups
- Actual and Commitment Update/Integration Integration Maintain Field Status for Assigning FM Account Assignments
For more information, see the documentation on Funds Management on SAP Help Portal at help.sap.com ERP Central Component Accounting Public Sector Management .
For Grants Management, note the following system settings in Customizing for Public Sector Management under Funds Management Government Master Data Grant :
- GM Grant Control:Field Group for Authorizations
- Maintain Grant Authorization Types
- Maintain Grant Authorization Groups
## 13.13.5.3.2  Public Sector Collection and Disbursement
The following security chapter of SAP Public Sector Collection and Disbursement (PSCD) also applies security information for SAP Tax and Revenue Management (TRM).
## 13.13.5.3.2.1  Data Storage Security
## Using Logical Path and File Names to Protect Access to the File System
The Industry Solution Migration Workbench (ISMW) saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
## Logical File Names / Path Names Used
The Migration Workbench uses the logical file name ISMW\_FILE with the logical file path ISMW\_ROOT to enable the validation of physical file names.
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). T o find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log.
For more information, see about data storage security, see the respective chapter in the ABAP Platform Security Guide.
## 13.13.5.3.4  Multichannel Foundation for Utilities and Public Sector (Public Sector)
## 13.13.5.3.4.1  Internet Communication Framework Security (ICF)
You should only activate the services that are required by the applications running in your system.
The following services must be activated for Multichannel Foundation for Utilities and Public Sector:
- ERP\_FMCA\_MC (logon user/current user)
- ERP\_FMCA\_MC\_PUBLIC\_SRV
ERP\_FMCA\_MC\_PUBLIC\_SRV is to be used for the anonymous payment or anonymous form submission scenario and needs to be linked to a predefined 'SU01' user.
Use transaction SICF to activate these services. If your firewalls use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
For more information about ICF security, see the relevant chapter in the ABAP Platform Security Guide.
## 13.13.6  Services
## 13.13.6.1  Engineering, Construction, and Operations
## 13.13.6.1.1  Equipment and Tools Management
## 13.13.6.1.1.1  Authorizations
Equipment and Tools Management (ETM) uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used:
| Authorization Object   | Description                       |
|------------------------|-----------------------------------|
| J_3GBLART              | Authorizations for document types |
| Authorization Object   | Description                                      |
|------------------------|--------------------------------------------------|
| J_3GEQART2             | CEM-Equipment Types for Document Category 2      |
| J_3GEMPGR2             | CEM-Recipient Groups, Document Category 2        |
| J_3GBEWTP2             | CEM-Transaction Types, Document Category 2       |
| J_3GACTVT              | CEMAllowed Activities                            |
| J_3GABRLST             | Call CEMSettlement List for Organizational Units |
| J_3GDISPGR             | MRPGroup in Equipment                            |
| J_3GDBER               | Planning Area in Recipient                       |
| J_3G_TCODE             | Transaction Code                                 |
## 13.13.6.1.1.2  Deletion of Personal Data
## Use
Equipment and Tools Management (ETM) might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                                  | Provided Deletion Functionality   |
|----------------------------------------------|-----------------------------------|
| Equipment and Tools Management (IS-ADEC-ETM) | Archiving Object                  |
|                                              | /SAPCEM01                         |
|                                              | /SAPCEM02                         |
|                                              | /SAPCEM03                         |
|                                              | /SAPCEM04                         |
|                                              | /SAPCEM05                         |
|                                              | /SAPCEM06                         |
|                                              | /SAPCEM07                         |
|                                              | ILM Object                        |
|                                              | SAPCEM_01                         |
|                                              | SAPCEM_02                         |
|                                              | SAPCEM_07                         |
|                                              | Reports                           |
|                                              | /SAPCEM/ILM_DELETION_REP_01       |
## Relevant Application Objects and Available EoP/WUC functionality
| Application                         | Implemented Solution (EoP or WUC)   | Further Information         |
|-------------------------------------|-------------------------------------|-----------------------------|
| Equipment and Tools Management (IS- | EoP                                 | Checks tables /SAPCEM/BDPO, |
| ADEC-ETM)                           |                                     | J_3GBELP                    |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
## 13.13.6.2  Professional Services
## 13.13.6.2.1   Commercial Project Inception and Lean Staffing
The following guide covers the information that you require to operate Commercial Project Inception and Lean Staffing securely.
## 13.13.6.2.1.1  Introduction
## Introduction
##  Note
This guide does not replace the administration or operation guides that are available for productive operations.
## Target Audience
- Technology consultants
- System administrators
This document is not included as part of the Installation Guides, Configuration Guides, Technical Operation Manuals, or Upgrade Guides. Such guides are only relevant for a certain phase of the software life cycle, whereas the Security Guides provide information that is relevant for all life cycle phases.
## Why Is Security Necessary?
With the increasing use of distributed systems and the Internet for managing business data, the demands on security are also on the rise. When using a distributed system, you need to be sure that your data and processes support your business needs without allowing unauthorized access to critical information. User errors, negligence, or attempted manipulation on your system should not result in loss of information or processing time. These demands on security apply likewise to Commercial Project Inception and Lean Staffing. To assist you in securing Commercial Project Inception and Lean Staffing, we provide this Security Guide.
## About this Document
The Security Guide provides an overview of the security-relevant information that applies to Commercial Project Inception and Lean Staffing .
## Overview of the Main Sections
The Security Guide comprises the following main sections:
- Before You Start This section references to other Security Guides that build the foundation for this Security Guide.
## · Authorizations
This section provides an overview of the authorization concept that applies to Commercial Project Inception and Lean Staffing .
## 13.13.6.2.1.2   Before You Start
It is important that you read and understand the information contained in the Authorizations [page 942] section that is specific to Commercial Project Inception and Lean Staffing. In addition, you should be aware of the information listed in the table below:
Fundamental Security Guides
| Scenario, Application or Component Security Guide   | Most-Relevant Sections or Specific Restrictions         |
|-----------------------------------------------------|---------------------------------------------------------|
| SAP Netweaver Application Server                    | ABAP Platform Security Guide - All sections             |
| SAP ECC                                             | SAP ERP Central Component Security Guide - All sections |
## 13.13.6.2.1.3  User Management and Authentication
SAP ECC Industry Extension Professional Services uses the user management and authentication mechanisms provided with ABAP Platform, particularly the Application Server ABAP . Consequently, the security recommendations and guidelines for user management and authentication that are described in the Application Server ABAP Security Guide also apply to SAP ECC Industry Extension Professional Services .
## User Types
It is often necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively have to change their passwords on a regular basis, but not those users under which background processing jobs run.
User type required for SAP ECC Industry Extension Professional Services is Dialog user. Dialog users are Individual users used for SAP GUI for Windows.
## 13.13.6.2.1.5  Data Storage Security
## Use
Commercial Project Inception and Lean Staffing stores additional employee-related data besides data stored in the HR Master Data database.
The following additional data can be stored in the respective objects (technical table names in parentheses):
- Employee assignment to projects, customer orders, or internal orders (SAWE\_D\_SA\_HDR and SAWE\_D\_SA\_ITM).
- Employee forecast for the above-mentioned assignments, and also for generic assignments such as training (SAWE\_D\_TIME\_PS and SAWE\_D\_TIME\_PSI).
For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ / help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Industries SAP for Professional Services Lean Staffing Data Archiving in Lean Staffing
## 13.13.6.2.1.6  Deletion of Personal Data
## Use
The Lean Staffing (IS-PRS-LS) component might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application               | Detailed Description                                                                                                                                                                                                                                                                | Provided Deletion Functionality                                                 |
|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
| Lean Staffing (IS-PRS-LS) | For more information, see the prod- uct assistance for SAP S/4HANA on the SAP Help Portal at https:/ / help.sap.com/s4hana_op_2021 under Product Assistance Enterprise Business Applications Industries SAP for Professional Services Lean Staffing Data Archiving in Lean Staffing | Archiving object SAWE_SA ILM object SAWE_SA Report SAWE_SA_CLEAN_CANDIDATE_LIST |
## Relevant Application Objects and Available EoP/WUC functionality
<!-- image -->
| Application               | Implemented Solution (EoP or WUC)   | Further Information                                                                                         |
|---------------------------|-------------------------------------|-------------------------------------------------------------------------------------------------------------|
| Lean Staffing (IS-PRS-LS) | End of Purpose (EoP) check          | Class registered for the EoP check: CL_WUC_IS_PRS_LS_EOP_CHECK For more information, see SAP note 2390575 . |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of customer and vendor master data in Customizing for Logistics - General under Business Partner Deletion of Customer and Vendor Master Data .
## 13.14  Country-Specifics
## 13.14.1  Deletion of Personal Data in Business Applications
The country-specific applications in the components of the listed business applications might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/ s4hana\_op\_2021 under Product Assistance Cross Components Data Protection .
For information about the available application objects and deletion functionality, see the country-specific function descriptions in the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ / help.sap.com/s4hana\_op\_2021 under Product Assistance by navigating to the specific function you are interested in.
## 13.14.2  Read Access Logging for Electronic Documents
The Document Compliance Framework provides a RAL (Read Access Logging) channel for Electronic Documents.
The Electronic Document channel allows logging to the RAL Manager (transaction SRALMANAGER ) in the following cases:
- Preview of eDocuments
- View or export of eDocument files
##  Note
- OData API is covered by the existing SAP Gateway (OData) RAL OData channel.
- Submission of eDocuments is out of scope for RAL logging.
The Electronic Document channel is identified with the following values:
Values for Electronic Document channel
## Field Name
Description
| EDOC_TYPE           | eDocument Type                                    |
|---------------------|---------------------------------------------------|
| FILE_TYPE           | eDocument: File Type for Read Access Logging      |
| INTERFACE_STRUCTURE | eDocument: File Structure for Read Access Logging |
SAP provides the Electronic Document RAL channel as well as the connection to the RAL Manager. The call of the RAL logging is done from the Document Compliance Framework. When creating a RAL configuration, the following list of fields is displayed for the Electronic Document channel entity:
- Administrative eDocument data (for example, eDocument type or eDocument process)
- Administrative eDocument file data (for example, eDocument file type or eDocument file name)
- eDocument type-specific fields (for example, for Portugal Invoice: Request ID)
- eDocument file content data:
- If the file structure is filled, then all the fields from the file structure are available for logging.
- If no file structure is defined, then all the data of the file can be logged without its structure (for example, a PDF file). The Electronic Document channel provides three fields for domain assignment.
When you access the RAL Manager with the Electronic Document channel, the system displays, for a given eDocument type, the file types for which RAL is enabled. You can then select the fields that may include sensitive personal data and for which you want to monitor and log read access.
## Related Information
Read Access Logging [page 33]
## 14 Business Network Integration
SAP S/4HANA currently supports integration scenarios with the Ariba Network (including Ariba Sourcing via the Ariba Network), and with SAP Fieldglass.
## 14.1 Security Aspects for Connectivity Types
In all of the connectivity types described below, only the on-premise system opens the connection to the Cloud, thus supporting the highest level of security. A proxy or reverse proxy in the demilitarized zone (DMZ) is not required.
The SAP S/4HANA system communicates with the business networks through the HTTPS protocol, encrypting transmitted data.
## Direct Connectivity
For direct connectivity, SAP S/4HANA always opens the connection by executing the following actions:
- SAP S/4HANA pushes cXML messages to the business networks (synchronous)
- The Polling Agent in SAP S/4HANA fetches pending messages from the business networks (synchronous)
## Mediated Connectivity
For mediated connectivity, the SAP S/4HANA system connects through SAP PI. The connection functions as follows:
- SAP S/4HANA pushes cXML messages to SAP PI (asynchronous)
- The Ariba Network Adapter for SAP NetWeaver triggers its Polling Agent to fetch pending cXML messages from Ariba Network. The Polling Agent in the PI adapter then pushes the cXML messages to the SAP S/4HANA system (asynchronous).
If SAP S/4HANA communicates with Ariba Network through SAP PI, there are no special security requirements.
<!-- image -->
##  Note
For mediated connectivity, Ariba provides information on how to communicate with Ariba Network in the Ariba Network Adapter for SAP NetWeaver Setup Guide . Y ou can contact Ariba for more information.
## 14.3 Direct Connectivity: SAP S/4HANA as Server
No proxy or reverse proxy is required. The asynchronous inbound application service interfaces are called either internally in the SAP S/4HANA system or by SAP PI.
## 14.4  Roles and Authorizations (Ariba Network)
A technical user is required in the SAP S/4HANA system to process messages coming from the Ariba Network. This user must not have the SAP\_ALL authorization. Assign the following roles to this user:
- SAP\_ARBFND\_INTEGRATION
The authorization object ARBFND\_ARB is required to execute reports and to process inbound messages. This object can be added by assigning the role SAP\_ARBFND\_INTEGRATION .
- Process Purchase Orders ( SAP\_MM\_PUR\_PURCHASEORDER )
This role provides authorization for purchase orders and is required to process incoming messages that update purchase orders.
- Process Inbound Deliveries ( SAP\_LE\_INB\_DEL\_PROCESSING ).
This role provides authorization for inbound deliveries and is required to process incoming messages that create inbound deliveries with receiving point.
- Enter Invoices for Verification in the Background ( SAP\_MM\_IV\_CLERK\_BATCH1 )
This role provides authorization to post or park incoming invoice documents in the background. Alternatively, you can assign any other role that contains the authorization object M\_RECH\_WRK .
Users who have to perform supplier-related Customizing activities must have the following authorization objects assigned to their role:
- F\_LFA1\_GEN with activity '03'
- F\_LFA1\_GRP with activity '03'
- F\_LFA1\_BEK with activity '03'
Depending on whether you use direct or mediated connectivity, you also have to assign one of the following roles:
- For direct connectivity: Web Service Consumer ( SAP\_BC\_WEBSERVICE\_CONSUMER )
- This role is required for using Web service protocol to communicate in direct connectivity.
- For mediated connectivity: Exchange Infrastructure: Service User for Application Systems ( SAP\_XI\_APPL\_SERV\_USER )
This role is required to communicate through XI protocol in mediated connectivity.
To make sure the corresponding profiles are available and active, you must generate the role profiles using transaction PFCG .
How to analyze I/O throughput on HANA? HANA I/O throughput statistics can be obtained from M_VOLUME_IO_* views. You can keep statistics from time "t" by resetting the M_VOLUME_IO_TOTAL_STATISTICS display,HANA I/O throughput statistics
How to analyze replication status? select * from "SYS"."M_SYSTEM_REPLICATION"; You can view the replication status with the query,HANA replication table
SAP best practices response time is as 1000 ms. for ABAP,ABAP dialog response time