orkungedik/SAP-basis-dataset huggingface dataset:
## 13.4.1.1  Data Storage Security
## Using Logical Path and File Names to Protect Access to the File System
Production Planning and Detailed Scheduling saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The data storage security of SAP NetWeaver and components installed on the base is described in the ABAP Platform Security Guide. All business data in SAP PP/DS is stored in the system database. If SAP LiveCache is used, some business data is also stored there. This business data is protected by the authorization concept of SAP NetWeaver and SAP PP/DS. In some special cases, business-relevant data is stored in another location, such as a file system. The special case is listed below:
## Logical File Names Used
The following logical file name has been created in order to enable the validation of physical file names:
- SAP SCM Optimizer
## Logical Path Names Used
The logical file names listed above all use the following logical file paths:
- &lt;drive&gt;:\usr\SAP\&lt;SID&gt;\&lt;Gxx&gt;\log (for Windows)
- \usr\sap\&lt;SID&gt;\&lt;Gxx&gt;\log (for Linux)
&lt;SID&gt;: Gateway ID on the SAP SCM Optimizer server
- &lt;Gxx&gt;: Gateway number
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). To find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log.
For more information, see about data storage security, see the respective chapter in the ABAP Platform Security Guide.
## 13.4.2  Manufacturing Execution for Discrete Industries
## 13.4.2.1  Authorizations for Just-in-Time-Processing
Just-in-Time Processing (JIT) uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used.
| Authorization Object   | Description                                            |
|------------------------|--------------------------------------------------------|
| C_AUTO_JIT             | ISAUTO_JIT: Sequenced JIT Calls (seqJC)                |
| C_JIT_CALL             | PP-FLW JIT Calls                                       |
| C_JIT_OUT              | IS-A-JIT: JIT Outbound Calls                           |
| JIT_S2P                | JIT Supply to Production: Authorizations for JIT Calls |
JIT\_S2P\_CC
JIT Supply to Production: Authorization for Control Cycles
## 13.4.2.2  Authorizations for Production Backflush
Production Backflush uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used.
| Authorization Object   | Description                                   |
|------------------------|-----------------------------------------------|
| C_BCKFLUSH             | Automotive: Production backflush              |
| C_APO_PPC              | APOAuthorization Object: Production Backflush |
## 13.4.2.3  Deletion of Personal Data
## Related Information
Deletion of Personal Data (Just-in-Time-Processing) [page 471] Deletion of Personal Data (Production Backflush) [page 474] Deletion of Personal Data (Production Order) [page 474]
## 13.4.2.3.2  Deletion of Personal Data (Production Backflush)
## Use
Production Backflush might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                     | Provided Deletion Functionality   |
|---------------------------------|-----------------------------------|
| Production Backflush (IS-A-PPC) | Archiving Object                  |
|                                 | PP_CONF                           |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components → Data Protection .
## 13.4.2.3.3  Deletion of Personal Data (Production Order)
## Use
Production orders might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
<!-- image -->
## Relevant Application Objects and Available Deletion Functionality
| Application                   | Detailed Description                                                                                                                                                                                                                                                                                                | Provided Deletion Functionality               |
|-------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------|
| Production Order (ERP_PP_SFC) | When a production order is created with reference to a sales order, the cus- tomer details are copied over from the sales order. In addition, the supplier data is taken from the purchasing data of the mate- rial. For extenally processed operations, the supplier data can also be maintained in the operation. | Archiving Object PP_ORDER ILM Object PP_ORDER |
## Relevant Application Objects and Available EoP/WUC functionality
| Application                   | Implemented Solution (EoP or WUC)   | Further Information   |
|-------------------------------|-------------------------------------|-----------------------|
| Production Order (ERP_PP_SFC) | End of Purpose (EoP) check          |                       |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of customer master/supplier master in Customizing for Cross-Application Components Data Protection Blocking and Unblocking of Data .
<!-- image -->
## 13.4.2.4  Data Archiving in Just-In-Time Supply to Customer
## Use
You archive data to remove from the database data that the system no longer needs, but which must still be accessible.
You use a specific archiving object to archive specific data.
## Features
It may be possible to display archived data. For more information, see the descriptions of the individual archiving objects.
## Activities
You can carry out archiving using the Manage Archiving Variants app.
## 13.4.2.4.1  Archiving Just-In-Time Call Data Using NJIT\_ICALL
You can use archiving object NJIT Call Inbound ( NJIT\_ICALL ) to archive NJIT calls.
The following programs are available for NJIT\_ICALL :
- Write program: NJIT\_I\_WRI
- Delete program: NJIT\_I\_DEL
- Read program: NJIT\_I\_READ\_AR\_SEQUENTIAL
You can find the following information:
- Tables -NJIT\_CALL\_D\_HDR , NJIT\_CALL\_D\_CGRP , NJIT\_CALL\_D\_CMAT , NJIT\_CALL\_D\_DREF , and NJIT\_CALL\_D\_RTXT
- Archiving Object -NJIT\_ICALL
## Checks
The following checks are carried out on JIT calls before they can be archived:
- The Write program can select only archivable NJIT calls, that is to say, for those which lifecycle status is completed.
## Prerequisites
JIT calls must be in a completed state to archive related data.
## 13.4.2.4.2  Archiving Just-In-Time Inbound Packaging Units Data Using NJIT\_IPKGU
You can use archiving object NJIT Inbound Packaging Units ( NJIT\_IPKGU ) to archive NJIT inbound packaging units.
The following programs are available for NJIT\_IPKGU :
- Write program: NJIT\_PKGU\_I\_WRI
- Delete program: NJIT\_PKGU\_I\_DEL
- Read program: NJIT\_PKGU\_I\_READ\_AR\_SE
You can find the following information:
- Tables -NJIT\_D\_PG\_HDR , NJIT\_D\_PG\_CNSMPN , NJIT\_D\_PG\_ITM , and NJIT\_D\_PG\_ITMREF
- Archiving Object -NJIT\_IPKGU
## Checks
The following checks are carried out before NJIT inbound packaging units can be archived:
- The Write program can select only archivable NJIT inbound packaging units, that is to say, those for which the package group status is set to Delivered .
## Prerequisites
Package groups must be in a Delivered state to archive related NJIT inbound packaging unit data.
## 13.4.2.4.3  ILM-Based Information for the Archiving Object
You must create policies and rules for the related ILM object NJIT Call Inbound ( NJIT\_ICALL ) using the Retention Management functions of SAP Information Lifecycle Management (SAP ILM).
To define retention rules using ILM policies (Using ILM Policies app), you can use the following condition fields and time references (start time for determining the retention period and residence period).
Available Condition Fields:
- Plant ( WERKS\_D )
Available Time References:
- Last Changed On ( LAST\_CHANGE\_DATE )
## 13.4.2.4.4  Business Partner End Of Purpose (EoP) Check in Just-In-Time Supply to Customer
Just-In-Time Supply to Customer provides an end of purpose (EoP) check to determine whether business partner data is still relevant for business activities in the application or can be blocked.
## Technical Details
The EoP check evaluates retention policies and data for ILM object NJIT\_ICALL .
The end of business for a JIT-relevant customer is reached when no JIT calls for that customer are active or in use. In other words, all their JIT calls must be set to a completed state. Execute transaction CVP\_PRE\_EOP to check if these conditions are met.
The EoP check for Just-In-Time Supply to Customer supports the use of application rule variants based on ILM rule groups. If you want to define differing residence and retention periods for business partner data depending on area-specific condition fields, you can use the following configuration apps to define and assign rule variants:
Assign Rule Variants and Groups for the Customer EoP Check : Both apps are used to assign the rule groups used in the ILM retention policies of an area-specific ILM object to the rule variants, which are used in combination with the area name to maintain the required residence and retention policies for the BP-related ILM objects ( FI\_ACCRECV ).
You can set up the rule groups for an ILM object in configuration app Manage ILM Object Groups .
## 13.4.2.4.5  Information Retrieval Framework in Just-In-Time Supply to Customer
The information retrieval feature supports you to comply with the relevant legal requirements for data protection by allowing you to search for and retrieve all personal data of a specified data subject.
While creating Purpose, you need to provide the ILM object name ( NJIT\_ICALL ).
## 13.4.2.5  Data Archiving in Just-in-Time Supply to Production
## Use
You archive data to remove from the database data that the system no longer needs, but which must still be accessible. For more information, see Introduction.
You use a specific archiving object to archive specific data.
For information about archiving objects in general, see The Archiving Object.
## Features
It is possible to display archived data.
## Activities
You can archive using the Manage Archiving Variants application. For more information, see Manage Archiving Variants.
## See Also
- Archiving Procedure
## Related Information
Archiving Just-In-Time Call Data Using NJIT\_OCALL [page 479]
Archiving Just-In-Time Communication Group Data Using NJIT\_OCGRP [page 480]
ILM Based Information for Archiving Object [page 481]
Business Partner End of Purpose (EoP) Check in Just-In-Time Supply to Production [page 482]
Information Retrieval Framework in Just-In-Time Supply to Production [page 483]
Archiving Just-In-Time Scheduling Agreement Using NJIT\_OSCHA [page 481]
## 13.4.2.5.1  Archiving Just-In-Time Call Data Using NJIT\_OCALL
You can use archiving object NJIT Outbound Call ( NJIT\_OCALL ) to archive NJIT calls.
The following are the available programs:
- Write : NJIT\_O\_WRI
- Delete : NJIT\_O\_DEL
- Read : NJIT\_O\_READ\_AR\_SEQUENTIAL
You can find the following information:
- Tables
- NJIT\_CALL\_D\_HDR
- NJIT\_CALL\_D\_CGRP
- NJIT\_CALL\_D\_CMAT
- NJIT\_CALL\_D\_DREF
- NJIT\_CALL\_D\_RTXT
- Archiving Object
- NJIT\_OCALL
## Checks
The required check on JIT calls before archiving them is:
- The Write program can select only archivable NJIT calls, that is, for those which lifecycle status is completed
## Prerequisite
- JIT calls must be completed to archive related data.
## Related Information
Data Archiving in Just-in-Time Supply to Production [page 478]
## 13.4.2.5.2  Archiving Just-In-Time Communication Group Data Using NJIT\_OCGRP
You can use archiving object NIJIT communication group, NJIT\_OCGRP to archive NJIT communication group data.
The available programs for NJIT\_OCGRP are, as below:
- Write : NJIT\_O\_WRI\_COMMUNICATION\_GRP
- Delete : NJIT\_O\_DEL\_COMMUNICATION\_GRP
- Read : NJIT\_O\_READ\_COMMUNICATION\_GRP
You can find the following information:
- Tables
- NJIT\_COMM\_GRP
- NJIT\_MSG\_PTNR
- Archiving Object
- NJIT\_OCGRP
## Checks
The required check must be performed before NJIT communication group is archived:
- The Write program can select only archivable NJIT communications groups, that is, for those for which the supplier and communication group status is set to Blocked .
## Prerequisites
- Communication group must be in Blocked status to archive related NJIT communication group data.
## Related Information
Data Archiving in Just-in-Time Supply to Production [page 478]
## 13.4.2.5.3  Archiving Just-In-Time Scheduling Agreement Using NJIT\_OSCHA
You can use archiving object scheduling agreement, NJIT\_OSCHA to archive NJIT purchasing scheduling agreements.
The following are the available programs:
- Write : NJIT\_O\_WRI\_PURCH\_SCHED\_AGRMT
- Delete : NJIT\_O\_DEL\_PURCH\_SCHED\_AGRMT
- Read : NJIT\_O\_READ\_PURCH\_SCHED\_AGRMT
You can find the following information:
- Table
- NJIT\_PURCH\_SA
- Archiving Object
- NJIT\_OSCHA
## Checks
For archiving of scheduling agrements, the retention and residence policies of the ILM objects have to be maintained.
## Prerequisites
- The JIT calls mapped for scheduling agreements must be completed.
## Related Information
Archiving Just-In-Time Call Data Using NJIT\_OCALL [page 479] Archiving Just-In-Time Communication Group Data Using NJIT\_OCGRP [page 480]
## 13.4.2.5.4  ILM Based Information for Archiving Object
You must create policies and rules for the related NJIT Outbound ILM objects ( NJIT\_OCALL , NJIT\_OCGRP , and NJIT\_OSCHA ) using the retention management functions of SAP Information Lifecycle Management (SAP ILM).
To define retention rules using ILM policies (Using ILM Policies application), you can use the following condition fields and time references (start time for determining the retention period and residence period).
## Available Condition Fields
- NJIT\_OCALL: Plant ( WERKS\_D )
- NJIT\_OCGRP and NJIT\_OSCHA: Supplier ( SUPPLIER )
## Available Time Preferences
- NJIT\_OCALL and NJIT\_OCGRP: Last Changed On ( LAST\_CHANGE\_DATE )
- NJIT\_OSCHA: Supplier ( LAST\_CHANGE\_DATE )
## Related Information
Data Archiving in Just-in-Time Supply to Production [page 478]
## 13.4.2.5.5  Business Partner End of Purpose (EoP) Check in Just-In-Time Supply to Production
Just-In-Time Supply to Production provides an end of purpose (EoP) check to determine whether business partner data is still relevant for business activities in the application or can be blocked.
## Technical Details
The end of purpose (EoP) check evaluates retention policies and data for ILM objects, NJIT\_OCALL , NJIT\_OCGRP , and NJIT\_OSCHA . The end of business for a JIT-relevant supplier or business partner is reached when no JIT calls for that supplier or business partner are active or in use. In other words, all their JIT calls must be set to completed. Execute transaction CVP\_PRE\_EOP to check if the conditions are met. The class CL\_NJIT\_EOP\_CHECK\_SUPPLIER is used to trigger end of purpose (EoP) that is assigned to the transation, CVP\_PRE\_EOP .
The EoP check for Just-In-Time supply to production supports the use of application rule variants based on ILM rule groups. If you want to define differing residence and retention periods for business partner data depending on area-specific condition fields, you can use the following configuration apps to define and assign rule variants:
## Assign Rule Variants and Groups for Supplier/Business PartnerCustomer EoP Check
Both applications are used to assign the rule groups used in the ILM retention policies of an area-specific ILM object to the rule variants, which are used in combination with the area name to maintain the required residence and retention policies for the BP-related ILM objects.
You can set up the rule groups for an ILM object in configuration application, Manage ILM Object Groups . For more information, see Manage ILM Object Groups.
## Related Information
Data Archiving in Just-in-Time Supply to Production [page 478]
## 13.4.2.5.6  Information Retrieval Framework in Just-In-Time Supply to Production
The information retrieval feature supports you to comply with the relevant legal requirements for data protection by allowing you to search for and retrieve all personal data of a specified data subject.
While creating purpose, you need to provide the ILM object name ( NJIT\_OCALL ).
For information on relevant BAdI, refer Information Retrieval Framework (IRF).
## Related Information
Data Archiving in Just-in-Time Supply to Production [page 478]
## 13.4.2.6  Data Aging for Just-In-Time Inbound/Outbound (DAAG\_NJIT\_I)
Data aging enables you to move large volumes of data within a database so as to gain more working memory. The data is moved from the current area (hot area) to the historical area (cold area).
You can use data aging for your inbound and outbound Just-In-Time calls (Data aging object DAAG\_NJIT\_I).
Data aging can only be applied to completed JIT calls.
The standard residence time is 100 days. Once the JIT calls have been moved to the historical area, you can no longer access them.
## 13.4.2.7  Input Sanitization for Just-In-Time Processing Applications
Input sanitization attempts to prevent malicious data by validating input content. The free text input fields in applications of Just-In-Time Supply to Customer and Just-In-Time Supply to Production support alphanumeric characters and selected special characters only.
## 13.4.3  Manufacturing Execution for Process Industries
## 13.4.3.1  Deletion of Personal Data (Process Orders)
## Use
Process orders might process data (personal data) that is subject to the data protection laws applicable in specific countries. You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data. For more information, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Relevant Application Objects and Available Deletion Functionality
| Application                | Detailed Description                                                                                                                                                                                                                                                                                           | Provided Deletion Functionality               |
|----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------|
| Process Order (ERP_PP_SFC) | When a process order is created with reference to a sales order, the customer details are copied over from the sales order. In addition, the supplier data is taken from the purchasing data of the mate- rial. For extenally processed operations, the supplier data can also be maintained in the operation. | Archiving Object PR_ORDER ILM Object PR_ORDER |
## Relevant Application Objects and Available EoP/WUC functionality
| Application               | Implemented Solution (EoP or WUC)   | Further Information   |
|---------------------------|-------------------------------------|-----------------------|
| Process Order (ERP_PP_PI) | End of Purpose (EoP) check          |                       |
## Configuration: Simplified Blocking and Deletion
You configure the settings related to the blocking and deletion of customer master/supplier master in Customizing for Cross-Application Components Data Protection Blocking and Unblocking of Data .
<!-- image -->
## 13.4.4  Project Manufacturing Management and Optimization
## 13.4.4.1  PMMO Authorizations
The following authorization objects are used for pegging, distribution and migration:
| Authorization Object   | Field   | Value                                                                                                                                                                                                                                                                                                      | Description               |
|------------------------|---------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------|
| I_PMMO_PEG             | ACTVT   | • 02 - Execute report and write pegging results to the database table PMMO_ASSIGNMENT . • 03 - Execute the report without writing the re- sults to the database. • F4 - Input help for FIORI apps.                                                                                                         | Pegging                   |
| I_PMMO_DIS             | ACTVT   | • 02 - Execute the report and post the account- ing documents to SAP Financials. • 03 - Execute the re- port without posting ac- counting documents. • 89 - Execute the report with a profile that has the undistribute all or undistribute unpegged function activated. • F4 - Input help for FIORI apps. | Cost Distribution         |
| I_PMMO_MIG             | ACTVT   | • 02 - Execute report and write migration results to the variousPMMOda- tabase tables. Set indicator Migration Completed . • 03 - Execute the report without writing the re- sults to the database.                                                                                                        | Migration from GPDto PMMO |
## Other Authorizations
The authorization object S\_DEVELOP is used by the PMMO Release Comparison Tool to be able to start the report.
The authorization object S\_TABU\_DIS is used by PMMO Customizing .
The authorization object SAP\_BR\_BUSINESS\_ANALYST\_PMM is used by the Fiori app Pegging Assignements with Costs .
## 13.4.5  Quality Management
## 13.4.6  Maintenance Operations
## 13.4.6.1  Authorizations in Plant Maintenance
## Standard Roles
SAP delivers business role templates which follow the naming convention SAP\_BR\_*. The delivered business role templates are designed to cover typical activities of business users with a certain job profile.
## Example
The delivered business role template SAP\_BR\_MAINTENANCE\_TECHNICIAN is designed for maintenance technicians. The role contains business catalogs which cover all the functions that a maintenance technician requires to carry out their work effectively and safely.
Another example business role template SAP\_BR\_MAINTENANCE\_PLANNER is designed for maintenance planners. The role contains business catalogs which cover a broad range of functions necessary for planning and executing maintenance activities.
Each business catalog contains one or more applications and is designed to support segregation of duty.
##  Note
For more information about how to create roles, see Role Administration [page 13].
## 13.4.7  Environment, Health and Safety
## 13.4.7.1  User Administration and Authentication
Environment, Health, and Safety (EHS) uses the authorization concept provided by the Application Server ABAP. Therefore, the security recommendations and guidelines for user administration and authentication as described in the Application Server ABAP Security Guide apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
For more information, see User Administration and Authentication [page 10].
## 13.4.7.1.1  User Management
The table below shows the standard users that are necessary for operating Environment, Health, and Safety (EHS). For more information about user management, see User Management [page 10].
| User ID                        | Type               | Password      | Description                                            |
|--------------------------------|--------------------|---------------|--------------------------------------------------------|
| Business processing user       | Dialog user        | To be entered | Business user of EHS                                   |
| E-mail inbound processing user | Communication user | Not needed    | User to process the incoming e-mails of EHS            |
| Workflow engine batch user     | Background user    | Not needed    | User for the background processing of workflows in EHS |
Users are not automatically created during installation. You can create them after the installation to avoid the need to change their IDs and passwords once the installation is completed.
##  Note
Several business processes within EHS use SAP Business Workflow and e-mail inbound and outbound processing. It is not recommended that you grant the corresponding system users (such as WF\_BATCH for Workflow System or SAPCONNECT for e-mail inbound processing) all authorizations of the system ( SAP\_ALL ).
## 13.4.7.1.2  Communication Destinations
The table below provides a list of the communication destinations that are used by Environment, Health, and Safety (EHS).
| Destination   | Delivered   | Type   | Description                                                                            |
|---------------|-------------|--------|----------------------------------------------------------------------------------------|
| <OHsystem>    | No          | RFC    | Connection to the SAP EHS Management for SAP S/ 4HANA, Occupational Health application |
| <PMsystem>    | No          | RFC    | Connection to Plant Maintenance system                                                 |
| <EWMsystem>   | No          | RFC    | Connection to the Extended Warehouse Management system                                 |
For general information about communication destinations, see Communication Destinations [page 20].
For detailed information about communication destinations, see Customizing for Environment, Health, and
Safety under Foundation for EHS Integration Specify Destinations for Integration .
## 13.4.7.3  Data Storage Security
## Using Logical Path and File Names to Protect Access to the File System
In Environment, Health, and Safety (EHS), the XML export for Incident Management saves data in files on the file system. Therefore, it is important to explicitly provide access to the corresponding files without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
Here are the logical file names and paths used by EHS together with the programs that they apply to:
## Logical File Names Used
The following logical file name has been created in order to enable the validation of physical file names:
- EHHSS\_INCIDENTS\_XML
- Program R\_EHHSS\_ALL\_INC\_TO\_XML uses this logical file name and the respective logical path to generate an XML file that contains all data for incidents.
## Logical Path Names Used
The logical file name listed above uses the logical file path EHHSS\_BO\_XML\_EXPORT\_PATH .
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). T o find out which paths are used by your system, activate the corresponding settings in the Security Audit Log .
For more information, see the Data Storage Security chapter in the ABAP Platform Security Guide.
## 13.4.7.4  Data Protection
Environment, Health, and Safety processes personal data that is subject to the data protection laws applicable in specific countries/regions. Personal data is processed in business cases, such as the following:
- In Incident Management processes, personal data is displayed when reporting absences or injuries.
- In Health and Safety Management processes, personal data is displayed about the risk assessment lead and the other persons involved in a risk assessment.
- In Environment Management processes, personal data is displayed about the persons assigned to compliance scenarios and the persons involved in tasks.
Environment, Health, and Safety (EHS) assumes that agreements for storage of personal data are covered in individual work contracts. This also applies to notifications on initial data storage.
For general information, see Data Protection [page 31].
## 13.4.7.4.3  Change Logging
Personal data is subject to frequent changes. Therefore, for review purposes or as a result of legal regulations, it may be necessary to track the changes made to this data. When these changes are logged, you can check which employee made which change, the date and time, the previous value, and the current value. It is also possible to analyze errors in this way.
Environmental, Health, and Safety (EHS) generates change documents for changes in specific fields of the objects that contain personal data.
In Display Change Document Objects (transaction SCDO ), you can find the delivered change document objects (EHS change document objects start with EHFND *, EHHSS *, and EHENV *). Under Maintain Logging Setting (transaction S\_AUT01 ), you can specify the fields to be logged.
You can access the change documents of objects for which you activated the change logging by choosing the corresponding option from the You can also dropdown list in the respective app. You can enter parameters to limit the changes that are displayed. To view change documents, you need the authorization object EHFND\_CHDC . In addition, under Evaluate New Audit Trail (transaction S\_AUT10 ) in Enhancement Mode , you can display all changes for the change document objects in EHS .
## More Information
- For more information about the use of change documents in EHS , go to https:/ /help.sap.com/ s4hana\_op\_2021, enter Foundation for EHS (EHS-SUS-FND) into the search bar, press Enter , open the search result with that title, and navigate to Technical Solution Information Creation of Change Documents .
<!-- image -->
- For more technical information about logging changes, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Changing Table and Data Element Logging into the search bar, press Enter , and open the search result with that title.
- For more information about change documents, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Logging Using Change Documents into the search bar, press Enter , and open the search result with that title.
## 13.4.7.5  Virus Scanning
The interactive forms of Environment, Health, and Safety (EHS) can contain Java Script. Therefore, Java Script must be enabled in Adobe Acrobat Reader. In addition, e-mails with PDF attachments that contain Java Script must not be filtered out in the e-mail inbound and outbound process.
For general information, see Virus Scanning [page 24].
## 13.4.7.6  Other Security-Relevant Information
This section contains additional security information that is relevant for Environment, Health, and Safety (EHS).
## 13.4.7.6.1  Dispensable Functions with Impact on Security
Environment, Health, and Safety (EHS) can be integrated with HR Time Management in Customizing. If the Personnel Time Management ( PT ) integration is activated, time data (including absences) from HR is displayed in the incident. An additional option is available to trigger the creation of HR absences from the incident. For all actions, HR authorizations are checked.
## 13.4.7.6.2  Security Settings for the Report Incident App
You use SAP Mobile Services to implement the Report Incident app. For more information on the security settings, go to the SAP Help Portal at https:/ /help.sap.com , enter SAP Mobile Services (Cloud Foundry) , press Enter , and open the search result with that title.
## 13.4.7.6.3  Allowlisting of Calculation Functions in the Environment Management Calculation Engine
The calculation engine allows the processing of custom function modules specified with the FUNC predicate in a calculation expression. In order to eliminate abuse of this functionality, only allowlisted function modules can be used with the FUNC predicate.
For more information, see the Customizing activity under Environment, Health, and Safety
Environment Management General Configuration Specify Allowed ABAP Function Modules in User-Defined Calculations .
## 13.4.7.7  Management of Change
The following chapters of the Security Guide provide an overview of the security-relevant information that applies to Management of Change .
## 13.4.7.7.1  ICF Security in Management of Change
To use apps in Management of Change , you have to activate the internet communication framework (ICF) service that is needed for the specific app.
For general information, see ICF Security [page 21].
In your front-end system, open HTTP Service Hierarchy Maintenance (transaction SICF ). Under / default\_host/sap/bc/ui5\_ui5/sap/ , activate the following UI5 services:
- moc\_manactys1 ( Manage Change Activities )
- moc\_manchgreqs1 ( Manage Change Request - MOC )
- moc\_reqactdas1 ( Change Requests and Activities - Detailed Analysis )
- moc\_alp\_creqs1 ( Change Requests Dashboard )
- moc\_alp\_actys1 ( Change Activities Dashboard )
In your back-end system, open HTTP Service Hierarchy Maintenance (transaction SICF ) and activate the Web Dynpro services under default\_host sap bc webdynpro moc .
## 13.4.7.7.2  Data Protection and Privacy
Management of Change might process personal data that is subject to the data protection laws applicable in specific countries/regions. For example, personal data is processed when information about persons involved in change requests and activities is displayed.
Management of Change assumes that agreements for storage of personal data are covered in individual work contracts. This also applies to notifications on initial data storage.
For general information, see Data Protection [page 31].
## 13.4.7.7.2.1  Deletion of Personal Data
You can use SAP Information Lifecycle Management (ILM) to control the blocking and deletion of personal data in Management of Change .
For more information about ILM and data protection in SAP S/4HANA, go to https:/ /help.sap.com/ s4hana\_op\_2021 under:
- Product Assistance Cross Components SAP Information Lifecycle Management
- Product Assistance Cross Components Data Protection
## Relevant Application Objects and Available Archiving Functionality
The following table lists the relevant application objects and the available archiving functionalities for Management of Change .
Application Objects and Available Deletion Functionalities in Management of Change
| Application Object     | Provided Archiving Functionalities                        |
|------------------------|-----------------------------------------------------------|
| Activity               | Archiving object /IAM/ACT Related ILM object IAM_ACTIVITY |
| Change request (issue) | Archiving object /IAM/ISSUE Related ILM object IAM_ISSUE  |
For more information about application objects and archiving functionality, go to https:/ /help.sap.com/ s4hana\_op\_2021 and proceed as follows:
- Enter Data Archiving in Management of Change into the search bar, press Enter and open the search result with that title.
## Configuration: Simplified Blocking and Deletion
In Management of Change , you configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection :
- Define the settings for authorization management under Authorization Management . For more information, see the Customizing documentation.
- Define the settings for blocking in Customizing under Blocking and Unblocking Business Partner .
For more information about simplified blocking and deletion, go to https:/ /help.sap.com/s4hana\_op\_2021 and proceed as follows:
- Enter Simplified Blocking and Deletion into the search bar, press Enter and open the search result with that title.
## 13.4.7.7.2.2  Change Log
Personal data is subject to frequent changes. Therefore, for revision purposes or as a result of legal regulations, it may be necessary to track the changes that have been made to this data. When these changes are logged, you can check which employee made which changes, the date and time, the previous value, and the current value. It is also possible to analyze errors in this way.
## Setting Up Change Logs for Management of Change
Management of Change processes personal data of business partners that are involved in change requests and activities. If any changes are made regarding the business partner, the system logs the following information on personal data per change request and activity:
- The user who has changed data
- Data and the time of the change
- The change type (update, insert, deletion, single field documentation)
- The identifying keys and their values of the data records
- The heading name for the attribute that has been changed
You can define the fields to be logged in Display Change Document Objects (transaction SCDO ).
You use the authorization object IAM/CHGLOG to control the change logging for change requests and activities.
## More Information
- For more information about change documents, go to https:/ /help.sap.com/s4hana\_op\_2021 and proceed as follows:
- Enter Services for Application Developers into the search bar, press Enter , open the search result with that title, and navigate to Change Documents .
- Enter "Auditing and Logging" into the search bar, press Enter , and open the search result with that title.
- For more information about logging changes of change requests and activities in Management of Change , go to https:/ /help.sap.com/s4hana\_op\_2021, enter Displaying Changes in Objects in Management of Change into the search bar, press Enter , and open the search result with that title.
## 13.5 R&amp;D / Engineering
## 13.5.1  Product Compliance
## 13.5.1.1  Service Role and User for SAP Business Workflow
The SAP\_WFRT user with the SAP Business Workflow Service User ( SAP\_BC\_BMT\_WFM\_SERV\_USER ) role is delivered with the SAP S/4HANA system. This user is required and responsible for executing the SAP Business Workflow functions. In the context of Product Compliance, this user calls the program that executes the Product Compliance Event Processing in the background.
The ABAP platform authorization concept is based on assigning authorizations to users based on roles. To maintain roles for ABAP technology, you use the profile generator (transaction PFCG ).
##  Note
For more information about how to create roles, see Role Administration [page 13].
The following table displays the security-relevant authorization objects that the technical user SAP\_WRFT needs to execute Product Compliance Event Processing in the background:
| Authorization Object   | Field     | 'From' Authorization Value     | Description                                                         |
|------------------------|-----------|--------------------------------|---------------------------------------------------------------------|
| S_PROGNAM              | P_ACTION  | BTCSUBMIT                      | Schedule programs for back- ground processing                       |
|                        |           | SUBMIT                         | Execute ABAP program                                                |
|                        | P_PROGNAM | R_EHFND_PCEP_EVT_QUEUE _WORKER | A program that processes all production compliance events and tasks |
| S_PROGRAM              | P_ACTION  | BTCSUBMIT                      | Schedule programs for back- ground processing                       |
|                        |           | SUBMIT                         | Execute ABAP program                                                |
|                        | P_GROUP   | WF_ADMIN                       | Workflow Administration                                             |
## 13.5.2  Product Safety and Stewardship
## 13.5.2.1  Product Compliance for Discrete Industries
## 13.5.2.1.1  User Administration and Authentication
Product Compliance for Discrete Industries uses the authorization concept provided by SAP NetWeaver. Therefore, the recommendations and guidelines for authorizations as described in the ABAP Platform Security Guide also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG).
For more generic information see User Administration and Authentication [page 10] in the Introduction section
## 13.5.2.1.1.1  User Management
The table below shows the standard users that are necessary for operating Product Compliance for Discrete Industries . For more generic information, see User Management [page 10] in the Introduction section.
| User ID                        | Type               | Password      | Description                                                           |
|--------------------------------|--------------------|---------------|-----------------------------------------------------------------------|
| Business processing user       | Dialog user        | To be entered | Business user of Product Compliance                                   |
| E-mail inbound processing user | Communication user | Not needed    | User to process the in- coming e-mails of Product Compliance          |
| Workflow engine batch user     | Background user    | Not needed    | User for the background processing of workflows in Product Compliance |
You need to create users after the installation. Users are not automatically created during installation. In consequence, there is no requirement to change user IDs and passwords after the installation.
<!-- image -->
##  Note
Several business processes within Product Compliance for Discrete Industries use SAP Business Workflow and e-mail inbound and outbound processing. It is not recommended that you grant the corresponding system users (such as WF\_BATCH for Workflow System or SAPCONNECT for e-mail inbound processing) all authorizations of the system (SAP\_ALL).
## 13.5.2.1.2  Network and Communication Security
Your network infrastructure is important for protecting your system. Therefore, your network must support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system level and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the backend system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit known bugs and security holes in network services on the server machines.
The network topology for Product Safety and Stewardship is based on the topology used by the ABAP Platform. Therefore, the security guidelines and recommendations described in the ABAP Platform Security Guide also apply here. Details that specifically apply to Product Safety and Stewardship are described in the following sections:
- Communication Channel Security [page 523] This topic describes the communication paths and protocols.
- Network Security [page 524] This topic describes the recommended network topology. It shows the appropriate network segments for the various client and server components and where to use firewalls for access protection. It also includes
a list of the ports required.
- Communication Destinations [page 524] This topic describes the information needed for the various communication paths, for example, which
users are used for which communications.
For more information, see the following sections in the ABAP Platform Security Guide :
- Network and Communication Security
- Security Guides for Connectivity and Interoperability Technologies