+APP.4.2.A12 SAP Authorisation Development [Department, Developer] (S)

APP.4.2.A12 SAP Authorisation Development [Department, Developer] (S)

Technical authorisations SHOULD be developed on the basis of technical specifications. Furthermore, SAP authorisations SHOULD be adapted or created anew on the development system of the SAP landscape under consideration. In cases involving S/4HANA, this SHOULD also include authorisation development on HANA databases. Repository roles SHOULD be set up and transported, as well. Database privileges SHOULD NOT be assigned directly to users.

For software developed in-house (e.g. for transactions or authorisation objects), transaction SU24 SHOULD be maintained (assignments of authorisation objects to transactions). Full authorisation (*) or intervals in object values SHOULD be avoided.

Authorisation development SHOULD be carried out as part of change management.

It SHOULD be ensured that the production system in question is adequately protected against authorisation changes and that no developer keys are assigned. The respective quality assurance system SHOULD be operated in the same way as the production system when assigning authorisations and adding settings.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.14 Interception of Information / Espionage
blocks G 0.22 Manipulation of Information
blocks G 0.32 Misuse of Authorisation
blocks G 0.46 Loss of Integrity of Sensitive Information