+APP.4.2.A14 Identification of Critical SAP Authorisations [Department] (S)

APP.4.2.A14 Identification of Critical SAP Authorisations [Department] (S)

The handling of critical authorisations SHOULD be strictly controlled. These authorisations, roles, and profiles SHOULD be assigned restrictively. This SHOULD also be ensured for critical role combinations and additive effects, such as cross authorisations.

Critical authorisations SHOULD be regularly identified, reviewed, and evaluated. The SAP profiles SAP_ALL and SAP_NEW* and the SAP authorisation object S_DEVELOP (with change authorisations ACTVT 01 and 02) SHOULD not be assigned in a production system. Emergency users SHOULD be excluded from this requirement.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
blocks G 0.22 Manipulation of Information
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation