orkungedik/SAP-basis-dataset huggingface dataset:
## 13.2.11.4.2   Authorization Types
## Use
The authorization types control in detail which actions (such as Change commission contract ) a commission manager or a commission contract partner may perform in Incentive and Sales Force Management .
## Features
A differentiation is made between quantifying and qualifying authorization types.
| Authorization type                  | Controls the following:                                                                                                                                                                                                     |
|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Quantifying authorization           | • Amounts, quantities, and values in the condition techni- que                                                                                                                                                              |
| Qualifying authorization            | • Menu and screen options of individual transactions • Authorization for business transactions (in part, already regulated by deactivation of menu options) such as Cre- ate, Change, Display • Making Customizing settings |
| Structural authorization [page 212] | Taking into account structural considerations                                                                                                                                                                               |
## 13.2.11.4.2.1.1   Authorization Maintenance Transactions in ISF
The following transactions are required for authorization maintenance in Incentive and Sales Force Management:
| Transaction   | Description                                                                                                                                                                                               |
|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| PFCG          | The SU02 transaction has been replaced by the PFCG trans- action for Release 4.64 (role maintenance). The roles greatly simplify the creation of authorizations and profiles using the profile generator. |
| SU25          | Copying check indicator standard proposals for authoriza- tion objects and authorization field values                                                                                                     |
| SU24          | Maintenance of default values                                                                                                                                                                             |
| SU01          | User maintenance (assignment of profiles)                                                                                                                                                                 |
| SU20          | Definition of authorization fields                                                                                                                                                                        |
| SU21          | List of the object classes for creating authorization objects.                                                                                                                                            |
| SU53          | Display of authorization values of individual users                                                                                                                                                       |
## 13.2.11.4.2.2   Quantifying Authorizations
## Use
By using quantifying authorizationsyou can impose a control so that commission manager can only enter values up to a certain amount. If a quantifying authorization is overstepped, the commission case receives the status "pending".
## Integration
A commission manager is always assigned to a certain authorization group. This group contains the fields required for the quantifying authorization from various tables, along with their values and currencies. Function module CACS\_CHECK\_QUAN\_AUTH reads these values, and compares them with the values entered.
## Features
There are four different areas that are relevant for the quantifying authorization:
## Commission Contract
In the commission contract, a quantifying authorization was developed for areas:
Flat-rate remuneration
Settlement/payment
Guarantee
The system checks the following fields AMNT, RES\_MAX\_AMNT, RES\_RATE, THRESH\_AMNT in tables CACS\_REMARU, CACS\_RESRULE and CACS\_WARRU.
## Commission Case/Document Posting
In the commission case, only the fields DREM\_CONAMNT, REM\_CONAMNT and REM\_RATE in table CACS00\_LIN are checked.
## Document Posting
The total of the remuneration difference amounts/quantities is queried here.
## Condition Technique
Absolute, relative, and percentage amounts are checked in the condition technique.
These values are entered in the performance-related remuneration.
Field KBETR\_T in structure CACS\_S\_COND\_TC\_LINE\_BDT is checked.
## 13.2.11.4.2.3.1  Editing Structural Authorizations
## Use
Authorization profiles are used to control the specific authorizations for personnel planning and development.
## Features
You have the following options:
- Maintenance of Structural Profiles
- Assigning Structural Authorization Profiles
- Save user data in the SAP Memory: Defines the users for which the structural authorization data should be saved in the SAP memory. The main purpose of this function is to avoid performance problems with users that have large authorization
profiles.
## Activities
You define the structural authorizations in Customizing for Incentive and Sales Force Management under General Tools Authorizations Structural Authorization.
Define the following data:
Table T77UA "User Authorization"
| Attribute   | Type      |                       |
|-------------|-----------|-----------------------|
| Key         | Key       | Key                   |
| MANDT       | PK        | Client                |
| UNAME       | PK        | User name             |
| PROFL       | PK        | Authorization profile |
| BEGDA       | PK        | Validity start        |
| Attribute   | Attribute | Attribute             |
| ENDDA       |           | Validity end          |
## Table T77PS "Authorization Profile Texts"
| Attribute   | Type   |                                     |
|-------------|--------|-------------------------------------|
| Key         |        |                                     |
| MANDT       | PK     | Client                              |
| LANGU       | PK     | Language key                        |
| PROFL       | PK     | Authorization profile               |
| Attribute   |        |                                     |
| TEXTB       |        | Authorization profile (description) |
## 13.2.11.4.2.3.1.1  Defining Structural Profiles
## Features
You can define authorizations for the following areas:
- Planning variants
- Object types
- Object IDs
You can also use the following parameters and functions when defining authorization profiles:
## Evaluation paths
By entering a certain evaluation path, you stipulate that a user can only access objects along this evaluation path. If you use an evaluation path, you must make an entry in the object ID field.
## Status vector
You can use a status vector to stipulate that a user can only access objects whose link infotypes have a certain status (planned or active, for example).
## Level of display
You can use the level of display to stipulate up to which hierarchy level a user can access a structure.
## Period
You use this parameter to define the profile that is dependent on the validity period of the structure. For example, if you choose entry D (current day), the structural authorization only applies to the structure valid on the current day. If no date is stated, there is no restriction on the validity period of structures.
## Function module
The system uses function modules to determine the root object dynamically at runtime. In this case, you should not fill the object ID field with data, but you must specify the planning variant and object type. The advantage of using function modules is that if you define one single authorization profile, the system creates a user-specific profile on the basis of the dynamic determination of the root object at runtime.
There are two standard function modules:
## RH\_GET\_MANAGER\_ASSIGNMENT (determine organizational units for managers)
The root object determined using this function module is the organizational unit to which the user is assigned as manager on the basis of his/her position and the A012 link (is manager of). This function module works on a key date basis. This means that the only organizational units determined as being the root object for a user are those to which he/she is assigned as manager on the date or period selected.
## RH\_GET\_ORG\_ASSIGNMENT (organizational assignment)
The root object determined using this function module is the organizational unit to which the user is assigned for organizational purposes.
In addition, you can define profiles that contain a maintenance authorization. To do so, select the Maintenance processing type. This means that you can also execute function codes that have the Maintenance flag in table T77FC.
Overall authorization arises from the basic authorization and the restriction imposed by structural authorization.
## 13.2.11.4.2.3.1.2   Assigning Structural Authorizations
## Use
You assign the users a specific authorization profile, time-dependently.
Prerequisites
In the previous activity, you defined in the authorization profiles which of the specific authorizations are relevant for the personnel planning and development.
## Features
Users are assigned a specific authorization profile that is time-dependent.
You enter the names of generally authorized users in personnel planning and development to whom you need to assign application-specific authorization profiles.
##  Note
Users not explicitly mentioned are treated the same as the "SAP" user.
## Activities
1. Choose New Entries
2. Enter the user name.
3. Assign the user to the corresponding authorization profile. Enter the authorizations that should be contained in the PD profile. You can make as many entries as you wish. Enter the corresponding authorization key directly or select the authorization profile using the input help (F4).
4. Enter the beginning and end data to define the period in which the authorization profile is valid.
## Result
You have assigned the users a specific authorization profile, time-dependently.
## 13.2.11.4.2.4  Example: Creating a Commission Manager and Assigning Authorizations
## Use
A commission manager is responsible for processing commission cases, for which he or she requires the relevant authorizations. In Incentive and Sales Force Management (ISF), both the SAP Authorization Concept as well as the SAP ICM Authorization Concept are used. To check the authorizations of a commission manager, the following relationships have to be established:
1. Between Organizational Management and ISF
2. Between the BP role: commission manager and the SAP user name
## Prerequisites
An organizational structure with positions or organizational units for commission contract partners must exist for ISF.
## Procedure
1. To create a commission manager, in the main menu of ISF choose Administration System Administration Commission Manager Create. . Select a business partner category that you wish to create in the BP role: Commission Manager. The Create in BP Role field defaults to Commission Manager (New) .
.
2. Tab page Address Enter the relevant address data.
3. Tab page Identification Enter the SAP user. This establishes the relationship between the commission manager and the SAP user.
## Result
You have created a commission manager.
## 13.2.11.4.2.4.1  Assigning Commission Managers Structural Authorizations
## Use
Organization Management allows you to include the commission manager as the owner of a position in the company hierarchy. This fulfills the requirement of assigning the commission manager (quantitative and qualitative) authorizations. The commission manager may only process those commission contracts that are lower in the organizational structure.
## Prerequisites
A relationship must have been established between the BP role commission manager and the user name (SAP user name). You do this by specifying the USER ID (SAP user name) in the master data of the business partner. See Example: Creating a Commission Manager and Assigning Authorizations [page 217].
## Procedure
1. To assign a commission manager a position, in the main menu of ISF choose Master Data Organizational Plan .
2. Organization and Staff Assignment (transaction PPOME) or
3. General Structures (transaction PPSM)
4. For more information, go to the product page for ABAP Platform and SAP NetWeaver , choose your release and then Application Server ABAP - Infrastructure Other Services Services for Business Users Organizational Management Expert Mode Organizational Management Expert Mode Organizational Management .
5. Under General Structures , in the Object type and Object ID fields enter the data for your organizational unit.
6. Enter the key CACS\_GP in the Evaluation Path field and choose Enter .
7. The evaluation path CACS\_GP shows the chain of relationships Organizational Unit Position Person .
8. You can now assign one or more organizational units in the organizational structure to the positions with the relationship 290 - has administrator .
9. Now assign the position with the relationship - 008 holder to the required commission manager(s).
##  Recommendation
We recommend creating the positions of commission manager in a node of the organizational structure that is separate from the organizational units to avoid undesirable side-effects from other functions that are based on Organizational Management.
## Result
You have assigned a commission manager structural authorizations. The assigned commission manager can now process all commission contracts of organizational units that are lower in the hierarchy. For more information see Structural Authorization.
## 13.2.11.4.2.4.2  Assigning Commission Managers Qualifying and Quantifying Authorizations
## Use
A commission manager requires qualifying and quantifying authorizations to be able to carry out his or her work in ISF.
## Prerequisites
You have created a commission manager and assigned him or her in Organizational Management to an organizational unit, thus establishing the required structural authorizations.
## Assigning Commission Managers Qualifying Authorizations
Qualifying authorizations are assigned with the standard SAP authorization concept in ISF.
You access the authorization objects in the initial screen under Tools Administration UserMaintenance Information System Authorization Objects.
For further information, see the User Information System section of User and Roles (BC-SEC-USR) .
-  Recommendation
To create qualifying authorizations, we recommend using the roles of the 'PFCG' profile generator.
You access the roles with transaction PFCG.
For further information, see the Role Maintenance section of User and Roles (BC-SEC-USR) .
You will find sample standard roles in the commission system under transaction PFCG:
- Single Roles:SAP\_ICM\_S\_*
- Composite Roles:SAP\_ICM\_C\_*
## Assigning Commission Managers Quantifying Authorizations
You can assign commission managers quantifying authorizations as well as qualifying ones. In so doing, you restrict the qualifying authorizations to a greater degree.For more information, see Quantifying Authorizations .
## Result
You have now assigned the commission manager all the relevant authorizations.
## 13.2.11.5  Network and Communication Security
Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business and your needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the backend system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.
The network topology for Incentive and Sales Force Management is based on the topology used by the SAP NetWeaver platform . Therefore, the security guidelines and recommendations described in the SAP NetWeaver security guide also apply to ICM.Details that particularly apply to ICM are described in the following sections:
## Communication Channel Security
ISF uses RFC technology and communicates with any number of external systems such as CRM or an (external) policy management system.
The settlement data can be transferred to SAP systems (FI-AP; FI-AR; HR-PY; FS-CD) as well as non-SAP systems.
## Network Security
See the product page for ABAP Platform and SAP NetWeaver, choose your release and then Securing the ABAP Platform User Authentication and Single Sign-On Authentication and Infrastructure AS ABAP Authentication Infrastructure Secure Network Communications (SNC) .
## Communication Destinations
The communication destinations are not part of the standard delivery of ISF.
## 13.2.11.6   Virus Protection
## Use
If the application saves or transfers data that could contain viruses, you must ensure that there is an interface to a virus scanner.
##  Note
For more information on virus protection, see the SAP Service Marketplace under service.sap.com/ security Security in Detail SAP Security Guides SAP WebAS Security Guide (aka SAP Security Guide) in the SAP Security Guide, VOLUME II under Special Topics: Virus Protection and SAP GUI Integrity Checks.
## 13.2.11.7.2  Read Access Logging
If no trace or log is stored that records which business users have accessed data, it is difficult to track the person(s) responsible for any data leaks to the outside world. The Read Access Logging (RAL) component
can be used to monitor and log read access to data and provide information such as which business users accessed personal data, for example, of a business partner, and in which time frame.
In RAL, you can configure which read-access information to log and under which conditions.
For more information about RAL, Read Access Logging (RAL) in the documentation for SAP NetWeaver on the SAP Help Portal under http:/ /help.sap.com .
## 13.2.11.8  Revision Security in Incentive and Sales Force Management
## Use
Through integration of Incentive and Sales Force Management with other SAP components, revision security is achieved in different ways, depending on the SAP component.
## Features
## Archiving
Incentive and Sales Force Management ensures that master data and transaction data cannot be deleted by using the menu, reports, and so on. This is only possible when using the standard SAP archiving tool.
##  Note
For additional information on data archiving, go to the product page for SAP S/4HANA, choose your release and then Product Assistance :
- Enterprise Technology ABAP Platform Administrating the ABAP Platform Administration Concepts and Tools Solution Lifecycle Management Data Archiving .
- Enterprise Business Applications Finance Incentive and Sales Force Management Incentive and Commission Management Services and Tools Tools for Implementing Individual Process Steps Archiving in Incentive and Commission Management .
## Period and Version Management in Incentive and Sales Force Management
The two-dimensional period management ensures revision security for the master data and Customizing data on which the period management is based. This means that the transaction data is automatically secure in terms of revision. For additional information, see the SAP Library under Period and Version Management.
## HR Master Data
For information on revision security of HR master data, see the SAP Library under Personnel Management Personnel Administration Procedures in Personnel Administration Time Constraints in HR Master Data .
Change Document
Change documents are not used in Incentive and Sales Force Management since all relevant activities are logged using the period management tool.
For the business partner (in the roles of commission contract partner, commission manager, and commission recipient), changes are logged using change documents and these can be viewed at any time.
## Condition Technique
In Incentive and Sales Force Management , revision security is ensured in the condition technique using two-dimensional period management. For additional information, see Period Management in the Condition Technique .
## (External Data Transfer) Generates a Run Log
The run log contains information on EDT-specific activities in general (log level, number of records processed, information on the runtime, and so on).
The Incentive and Commission Management business function can also include process-specific information for each processed commission case in the EDT run log.
This is done using the following function modules:
CACS\_MSGEDT
CACSBATCHDISP
## Using the Basis Application Log (BAL)
The process logs all activities in the basis application log.
You can specify the level of detail in the log by setting suitable parameters/setting certain parameter IDs:
CACS\_MSGDISP
CACS\_MSGSTORE
CACS\_MSGEDT
CACS\_BATCHDSIP
## 13.2.11.9  Procedure Documentation in Incentive and Sales Force Management
## Use
Incentive and Sales Force Management offers a range of possibilities for establishing security mechanisms in the system but nonetheless it is not possible to cover all of the security-relevant and organization-specific aspects completely with ISF. In particular, it is down to you to make sure that all security-related requirements are covered with suitable procedure documentation.
##  Recommendation
For example, if a commission manager has access to personal data, the company must have a data protection statement to make sure that the data is not passed on.
## 13.3 Human Resources
## 13.3.3  Security-Relevant Logging and Tracing
Change documents are created for the infotypes of SAP Human Resources, on the basis of which you can trace changes to infotype data. For more information, see https:/ /help.sap.com/s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Human Resources HR Tools in the following sections:
- Creating Change Documents for Personnel Administration Infotypes
- Creation of Change Documents for Personnel Planning Infotypes
## 13.3.4  Core HR and Payroll
## 13.3.4.1  Core HR
## About This Chapter
This section of the Security Guide provides an overview of security-relevant information for Core HR .
## Overview of the Main Sections of This Chapter
The following sections contain the security-relevant information that is specific to Personnel Management:
- Important SAP Notes
This section lists the most important SAP Notes for the security of Personnel Management.
- Authorizations
This section provides an overview of the authorization concept used for Personnel Management.
- Communication Channel Security
This section provides an overview of the communication paths used by Personnel Management and provides information on how you can best protect them.
## · Communication Destinations
This section provides an overview of the communication destination for the components of Personnel Management and the country-specific components of Personnel Administration.
## · Data Storage Security
This section provides an overview of the critical data used by Personnel Management, as well as the security mechanisms used.
## · Security for Additional Applications
This section contains information about temporary sequential (TemSe) data storage, which only temporarily stores data from country-specific reports from Personnel Administration.
- Other Security-Relevant Information
This section contains information about security-relevant Customizing for infotype records and indicates the reports that perform database statistics and consistency checks without checking the user's authorizations.
- Chapter with the security-relevant information for the component HCM Processes and Forms
## 13.3.4.1.1  Authorizations
## Use
The Personnel Management components use the two-part authorization concept from SAP Human Resources. For more information, see section Authorizations in the SAP S/4HANA Security Guide for Human Resources section.
## Standard Roles
The table below shows the standard roles that are used by the Personnel Management components.
| Role           | Description                                                                                                 |
|----------------|-------------------------------------------------------------------------------------------------------------|
| SAP_HR_OS*     | Roles for the PA-OS (Organizational Structure) component                                                    |
| SAP_HR_PA_xx_* | Roles for the international versions and country versions of the component PA-PA (Personnel Administration) |
##  Note
For the roles marked with an asterisk (*), several roles exist for each of the components. For roles with 'xx' , where 'xx' represents the SAP country key, various roles exist for each of the country versions.
## Standard Authorization Objects
The Personnel Management components use the standard authorization objects from SAP Human Resources. For more information about the authorization objects for Human Resources, see SAP Library for SAP S/4HANA on SAP Help Portal at Human Resources HR Tools Authorizations for Human Resources Technical Aspects Authorization Objects .
## 13.3.4.1.2  Communication Channel Security
## Use
The table below shows the communication channels used by Personnel Management , the protocol used for the connection, and the type of data transferred.
| Communication Path                                 | Protocol Used                       | Type of Data Transferred                                                 | Data Requiring Particular Protection                           |
|----------------------------------------------------|-------------------------------------|--------------------------------------------------------------------------|----------------------------------------------------------------|
| Interface Toolbox (Transac- tion PU12)             | ALE                                 | Master data, Benefits data, organizational data as de- fined by the user |                                                                |
| SAPBW                                              | Extractor program                   | Master data, organizational data, Personnel Development data             |                                                                |
| SAPCO (for distributed systems)                    | RFC                                 | Cost centers, orders, and so on                                          | Authorizations for COob- jects are required here               |
| External files                                     | ASCII                               | Personnel Administration data                                            | Applicable only for country versions Australia and New Zealand |
| MSWord                                             | Report interface with SAP NetWeaver |                                                                          | Office Integration                                             |
| Connection of PDF-based print forms to the archive | HTTP(S)                             | Person-related data (for ex- ample, employee photo)                      |                                                                |
DIAG and RFC connections can be protected using Secure Network Communications (SNC). The Secure Sockets Layer protocol (SSL protocol) protects HTTP connections.
##  Note
If you convert the protocol from HTTP to HTTPS and use PDF-based print forms, see SAP Note 1461447.
For more information, see the SAP NetWeaver Security Guide under Transport Layer Security .
## 13.3.4.1.4  Data Storage Security
The infotypes in Personnel Management contain particularly sensitive data. This data is protected by central authorization objects.
##  Note
For more information about authorization objects, see section Authorizations in the SAP S/4HANA security guide for Human Resources .
## Examples of infotypes containing particularly sensitive data:
- International infotypes for Personnel Administration (PA-PA)
- Personal Data (0002)
- Basic Pay (0008)
- Bank Details (0009)
- Family Member/Dependents (0021)
- Personnel Development (PA-PD)
- Qualifications
- Appraisals
- Personnel Cost Planning and Simulation (PA-CP)
- Planning of Personnel Costs (0666), contains salary-based information
- Management of Global Employees (PA-GE)
- Compensation Package Offer (0706)
## Other sensitive Personnel Management data
- Budget Management
The Budget Management component accesses the salary data of employees and displays data from the Controlling (CO) and Funds Management (FI-FM) components. The standard authorization concept for Human Resources , Controlling , and Funds Management is used for these processes. The following authorization objects are also available to protect the data:
- P\_ENCTYPE ( HR: PBC - Financing ): Determines which funds reservation types a user can access and which activities the user is allowed to perform.
- P\_ENGINE ( HR: Authorization for Automatic Commitment Creation ): Determines which activities a user is allowed to perform when creating commitments.
- Pension Fund (PA-PF) Access to salary data, pensions, and benefits entitlements is protected by the following authorization
objects:
- P\_ORIGIN ( HR: Master Data )
- P\_CH\_CK ( HR-CH: Pension Fund: Account Access )
- P\_NL\_PKEV ( Bevoegdheidsobject voor PF-gebeurtenissen )
- Personnel Cost Planning ( PA-CM-CP and PA-CP ) The old Personnel Cost Planning ( ) and the new Personnel Cost Planning and Simulation ( )
PA-CM-CP PA-CP components both save salary-relevant information to the clusters of the database PCL5 . Y ou can control access rights using the authorization object P\_TCODE ( HR: Transaction Code ).
- Employee Interaction Center ( PA-EIC ) The EIC Authentication infotype (0816) enables question and response pairs to be saved that an agent of
Employee Interaction Center then uses to identify a calling employee. You can only maintain the infotype with the Authentication for EIC Employee Self-Service.
- HR Administrative Services ( PA-AS )
The personnel file and all process instances are saved with intermediate statuses and history to the Case Management databases.
## 13.3.4.1.5  Security for Additional Applications
Personnel Administration country-specific components use several reports that store security-relevant and sensitive data. This data includes employee data relating to salary, tax, social insurance, pension contributions, and garnishments.
The data is stored in temporary sequential (TemSe) files and used when printing legal forms, statistics, and business reports. Access to TemSe is controlled by the authorization object S\_TMS\_ACT. Data encryption is not necessary here. For a list of all reports and programs using TemSe, see the Personnel Administration documentation for your country version.
You can also download data directly from the front-end server (for example, PC/terminal) or application server without first storing the data records in the TemSe. To do so, you copy the data to a data carrier that you can then send to the authorities.
## 13.3.4.1.6  Other Security-Relevant Information
Use
## Other security-relevant Customizing for infotype records
With the field Access Auth. (Access Authorization) in table V\_T582A ( Infotype attributes (Customizing) ), you can control access to an infotype record depending on whether the record belongs to the area of responsibility of a person responsible on the current date. For more information, see Customizing for Personnel Management under Personnel Administration Customizing Procedures Infotypes Infotypes . Note in particular the help for the Access Authorization field.
## Technical utilities without integrated authorization check
The following technical utilities read data without the user's authorizations being checked. You should therefore only assign relevant report authorizations to roles containing system administrator functions.
- Reports with the prefix RHDBST*: Database statistics
- Reports with the prefix RHCHECK*: Consistency checks for Organizational Management and Personnel Development data.
If required, you can use the following reports (developed for SAP internal use) for testing purposes.However, SAP does not accept any responsibility for these reports:
- Report RPCHKCONSISTENCY: ( Consistency check for HR master data )
- Report RPUSCNTC ( Find Inconsistencies in Time Constraints )
## 13.3.4.1.7  HCM Processes and Forms
## About this Document
This chapter provides an overview of the security-relevant information that applies to HCM Processes and Forms (PA-AS).
## Overview of the Main Sections of This Chapter
The HCM Processes and Forms chapter comprises the following sections:
## · Before You Start
This section contains references to other Security Guides that build the foundation for the HCM Processes and Forms chapter and a list of the most important SAP Notes for HCM Processes and Forms regarding security.
## · Authorizations
This section provides an overview of the authorization concept that applies to HCM Processes and Forms .
- Internet Communication Framework Security This section provides an overview of the Internet Communication Framework (ICF) services that are used
by HCM Processes and Forms .
- Security for Additional Applications
This section provides information on a Business Add-In (BAdI) that can be used for the attachment handling of HCM Processes and Forms .
- Other Security-Relevant Information
This section provides information on the possibility of protecting the Customizing views of HR Administrative Services by a using a grouping option for the authorization check to prevent users without authorization from maintaining person-related data.
## 13.3.4.1.7.2  Internet Communication Framework Security
## Use
You should only activate those services that are needed for the applications running in your system. For HCM Processes and Forms , the following services are needed which you can find under the path default\_host/sap/bc/webdynpro/sap/ :
- asr\_form\_display
- asr\_keyword\_search
- asr\_launchpad
- asr\_mass\_start\_process
- asr\_OBJECT\_SEARCH
- asr\_pa\_pd\_processes\_display
- ars\_personnel\_file
- asr\_processes\_display
- ASR\_PROCESS\_EXECUTE\_FPM
- asr\_process\_select
- ars\_profiles\_show
- asr\_srch\_pd\_process
## Activities
Use the transaction SICF to activate these services.
If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
## More Information
For more information, see Activating and Deactivating ICF Services in the SAP NetWeaver Library documentation.
## 13.3.4.1.7.3  Security for Additional Applications
For the uploading of attachments in HCM Processes and Forms you can use Business Add-In (BAdI) HRASR00ATTACHMENT\_HANDLING for defining the file types allowed and the maximum size of attachments. For more information, see the BAdI documentation in the SAP S/4HANA system.
## 13.3.4.1.7.4  Other Security-Relevant Information
## Authorizations for the Implementation Guide for HR Administrative Services
The views in the Implementation Guide for HR Administrative Services are protected separately by a grouping for the authorization check to prevent users without authorization maintaining person-related data. Under the field name DICBERCLS ( Authorization Group ), you can set the following in the authorization object S\_TABU\_DIS :
- Switch PASC : Authorization check for all views of HR Administrative Services in which no Customizing settings were made that affect authorization checks for the users of HR Administrative Services.
- Switch PASA : Additional authorization check for the views that may affect the authorization check for users of HR Administrative Services.
## 13.3.4.1.8  Personnel &amp; Organization
## About This Chapter
This chapter of the Security Guide provides an overview of the security-relevant information for Personnel &amp; Organization (PA-PAO).
## Role and Authorization Concept for Personnel &amp; Organization
The Personnel &amp; Organization component uses the following authorization concepts:
- ABAP Platform authorization concept (based on assigning authorizations to users based on roles) For this purpose, the roles mentioned in section Standard Roles are available as a template. You can copy the standard roles to the customer name space and adjust them to suit your requirements. You use the profile generator (transaction PFCG ) to maintain roles.
- •
- Structural Authorizations (HCM-specific authorization concept) You configure structural authorizations in Customizing for Personnel &amp; Organization by choosing the following path: Security Authorizations Structural Authorizations . For more information about the structural authorization check, see Structural Authorization Check (in SAP Library for SAP S/4HANA under Human Resources HR Tools Authorizations for Human Resources ).
## Standard Roles
The following standard single roles are available for the Personnel &amp; Organization component: Single Roles for Personnel &amp; Organization .
## Gateway Information
For security information for Gateway, please see:
Security Settings in the SAP Gateway
The SAP Gateway Foundation Security Guide
Go to https:/ /help.sap.com/s4hana\_op\_2021, enter SAP Gateway Foundation Security Guide into the search bar, press Enter , and open the search result with that title.
## 13.3.4.2  Payroll (PY)
## About This Chapter
This section of the Security Guide provides an overview of security-relevant information for Payroll (PY).
## Overview of the Main Sections of This Chapter
The chapter 'Payroll' comprises the following main sections:
- Important SAP Notes
This section lists the most important SAP Notes with regard to the security of Payroll.
- User Management
This section provides an overview of the user types required for Payroll.
- Authorizations
This section provides an overview of the authorization concept used for Payroll. Note also the section Authorizations for Human Resources overall.
- Communication Channel Security
This section provides an overview of the communication paths used by Payroll.
- Data Storage Security
This section provides an overview of the critical data used by Payroll, as well as the security mechanisms used.
- Security for Third-Party Applications or Additional Applications
This section contains security information that applies for additional applications that are used together with Payroll (for example, the Interface Toolbox or B2A: Communication with Authorities).
- Country-Specific Features
This section contains additional security-relevant information for some country versions.
##  Note
The information in the chapter 'Payroll (PY)' applies for all country versions of Payroll. The countryspecific sections only contain additional country-specific information, if any exists.
## 13.3.4.2.1  Important SAP Notes
The following table lists the most important SAP Notes with regard to the security of Payroll.
<!-- image -->
<!-- image -->
| Title                                                          |   SAP Note | Comment                                                                                                                                                        |
|----------------------------------------------------------------|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Analyzing HRauthorizations                                     |     902000 | Contains general information about au- thorizations in the attachments                                                                                         |
| Q&A: How to customize Payroll Ac- counting postings in Rel.4.x |     116523 | Explains that the display authorizations for posting to Accounting are controlled using the report authorizations (that is, there are no table authorizations) |
## 13.3.4.2.2  User Management
## Definition
User management for Payroll uses the mechanisms provided by the SAP Web Application Server ( ABAP), for example, tools, user types, and password policies. For an overview of how these mechanisms apply for Payroll , see the sections below. In addition, there is a list of the standard users that are necessary for operating Payroll .
## User Management Tools
The table below shows the tools to use for user management with Payroll .
User Management Tools
| Tool                                           | Detailed Description                                                                           | Prerequisites   |
|------------------------------------------------|------------------------------------------------------------------------------------------------|-----------------|
| User and Role Maintenance (transac- tion PFCG) | You can use the Role Maintenance transaction PFCG to generate profiles for your Payroll users. |                 |
## User Types
It is often necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively have to change their passwords on a regular basis, but not those users under which background processing jobs run.
The user types required for Payroll include:
- Individual users
- Administration user
- Payroll manager
- Payroll specialist
- Technical users
- Payroll procedure administrator
- ALE user for posting payroll results to Accounting
For more information about these user types, see the SAP Web AS ABAP Security Guide under User Types.
## 13.3.4.2.4  Communication Channel Security
## Use
The table below shows the communication channels used by Payroll , the protocol used for the connection, and the type of data transferred.
Communication Paths
| Communication Paths                                                                                  | Protocol Used    | Type of Data Transferred                          | Data Requiring Special Pro- tection          |
|------------------------------------------------------------------------------------------------------|------------------|---------------------------------------------------|----------------------------------------------|
| Interface Toolbox (Transac- tion PU12)                                                               | ALE, local files | Determined by the user                            | Salary data, HRmaster data                   |
| Display posting runs (trans- action PCP0)                                                            | ALE              | Data for cost accounting                          | Salary data (accumulated in part)            |
| Display documents from Ac- counting                                                                  | ALE              | Documents from Accounting                         |                                              |
| Data medium files (creation in Accounting)                                                           | Local files      | Files for transfer of bank transfers to the banks | Salary data                                  |
| Display original document for an external wage component in infotype External Wage Components (0579) | RFC              | Documents from Accounting                         | Additional salary data from external systems |
RFC connections can be protected using Secure Network Communications (SNC). For more information, see the SAP NetWeaver Security Guide under Transport Layer Security.
##  Recommendation
We strongly recommend that you use secure protocols (SSL, SNC) where possible.
In addition, there is also an authorization check for calling the RFC-capable function module itself (CALL FUNCTION 'AUTHORITY\_CHECK\_RFC'). For more information, see SAP NetWeaver Library and choose RFC Programming in ABAP.
For more information about the security of ALE connections, see ABAP Platform Security Guide ALE.
## 13.3.4.2.6.1  B2A: Communication with Authorities
This section of the Security Guide provides an overview of security-relevant information for B2A: Communication with Authorities . B2A: Communication with Authorities is based on SAP S/4HANA Central Component and Human Resources. Therefore, the corresponding sections in the Security Guide also apply for B2A: Communication with Authorities .
B2A: Communication with Authorities is used by the following country versions:
- Germany For more information, see B2A: Communication with Authorities (PY-DE-BA) [page 280].
- Great Britain
For more information, see Country/Region-Specific Features: United Kingdom [page 318].
- Switzerland
- For more information, see Country/Region-Specific Features: Switzerland [page 311].
- The Netherlands For more information, see Country/Region-Specific Features: The Netherlands [page 313].
## Underlying Security Guides
| Security Guide of Scenario, Application, or Component               | Path                                                                                                    |
|---------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| Secure Store and Forward (SSF)                                      | SAP NetWeaver Developers' Guide in SAP NetWeaver Library under Secure Store and Forward Mechanism (SSF) |
| SAP Business Connector (BC)                                         | SAP Business Connector Security Guide                                                                   |
| SAP NetWeaver Exchange Infrastructure/Process Integra- tion (XI/PI) | SAP Process Integration (PI) Security Guides                                                            |
## Important SAP Notes
Currently, there are no security-relevant SAP Notes for B2A.
## Authorizations
For more information, see Authorizations .