+APP.4.2.A6 Creation and Implementation of a User and Access Control Policy [Department, Developer] (B)

APP.4.2.A6 Creation and Implementation of a User and Access Control Policy [Department, Developer] (B)

A user and access control policy MUST be developed and implemented for SAP ERP systems. The following points MUST be considered:

  • the identity principle, minimum principle, job principle, document principle of accounting, document principle of authorisation administration, segregation of duties principle (SoD), approval principle, standard principle, written form principle, and control principle MUST be taken into account.
  • User, authorisation, and profile administrators MUST have separate responsibilities and authorisations.
  • Procedures MUST be defined within authorisation administration for creating, changing, deleting, and transporting roles, as well as for transporting SU24 default values. Authorisation roles SHOULD be created and maintained in the development system. They SHOULD be transported using the Transport Management System (TMS). Authorisations SHOULD be created, saved, and assigned to the users in authorisation roles (PFCG roles) in a role-based access control policy. Since individual critical actions in the roles cannot always be avoided, they SHOULD be covered by mitigation controls.
  • Within the framework of the access control policy, procedures MUST be defined for the request, approval, modification, and deletion of users and authorisations.
  • Naming conventions MUST be defined for user IDs and technical role names.
  • Default values and check indicators SHOULD be maintained in transaction SU24. The corresponding procedure SHOULD be described in the user and access control policy.
  • Legal and internal framework conditions such as the German Generally Accepted Accounting Principles (German GAAP), the German Commercial Code (HGB), and the organisation's internal specifications MUST be taken into account. The user and access control policy SHOULD also cover the operation of technical accounts, including the authorisation of background and interface users.

Appropriate control mechanisms SHOULD be applied to check for SoD conflicts in roles and monitor the assignment of critical authorisations to users.

If components such as SAP HANA and SAP NetWeaver Gateway (for Fiori applications) are used in addition to the ABAP back end, the design of the authorisations among the components MUST be coordinated and synchronised.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
blocks G 0.14 Interception of Information / Espionage
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.25 Failure of Devices or Systems
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.39 Malware
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information