+APP.4.2.A14 Identification of Critical SAP Authorisations [Department] (S)

APP.4.2.A14 Identification of Critical SAP Authorisations [Department] (S)

The handling of critical authorisations SHOULD be strictly controlled. These authorisations, roles, and profiles SHOULD be assigned restrictively. This SHOULD also be ensured for critical role combinations and additive effects, such as cross authorisations.

Critical authorisations SHOULD be regularly identified, reviewed, and evaluated. The SAP profiles SAP_ALL and SAP_NEW* and the SAP authorisation object S_DEVELOP (with change authorisations ACTVT 01 and 02) SHOULD not be assigned in a production system. Emergency users SHOULD be excluded from this requirement.

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai

Susietos užduotys

Saitai
blocks G 0.22 Manipulation of Information
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation