Administration Guide CUSTOMER

Document Version: 1.0.7 – 2018-01-01

SAP Management of Change (powered by SAP NetWeaver)

Content

1 Getting Started. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.1 About this Document. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.2 Related Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61.3 Important SAP Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8

2 SAP Management of Change Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.1 Introduction to SAP Management of Change. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.2 System Landscape. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.3 Software Units of SAP Management of Change. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Application Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Technology Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13SAP NetWeaver Process Integration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13SAP Business Suite Foundation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.4 Business Process for SAP Management of Change. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3 Installation Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163.1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163.2 Software Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

4 Operation Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184.1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184.2 Monitoring of SAP Management of Change. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Alert Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Monitoring Installation and Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Detailed Monitoring and Tools for Problem and Performance Analysis. . . . . . . . . . . . . . . . . . . . . . . 19

4.3 Management of SAP Management of Change. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Software Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Business Configuration Sets (BC Sets). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Administration Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Backup and Restore. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24User Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Printing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.4 Software Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Transport and Change Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Development Requests and Development Release Management. . . . . . . . . . . . . . . . . . . . . . . . . . . 25

2 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Content

Support Packages and Patch Implementation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254.5 Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Troubleshooting the Process Foundation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .264.6 Support Desk Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Remote Support Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Problem Message Handover. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

5 Security Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285.1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285.2 Before You Start. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285.3 Technical System Landscape. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295.4 User Administration and Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30User Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30User Data Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Integration Into Single Sign-On Environments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

5.5 Authorizations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .335.6 Session Security Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365.7 Network and Communication Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37Communication Channel Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Network Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Communication Destinations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

5.8 Internet Communication Framework Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395.9 Data Storage Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405.10 Data Protection and Privacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40Deletion of Personal Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43Information Report. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46Change Log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

5.11 Enterprise Services Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475.12 Services for Security Lifecycle Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .485.13 Security-Relevant Logging and Tracing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

6 Solution-Wide Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .506.1 Solution Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506.2 Service-Oriented Architecture (SOA). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .506.3 Service Enablement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .506.4 Installation of the Service-Oriented Architecture (SOA). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516.5 Related Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

SAP Management of Change (powered by SAP NetWeaver)Content C U S T O M E R 3

6.6 List of References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

A Appendix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54A.1 List of Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54A.2 List of Documents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54A.3 Media List. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

4 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Content

1 Getting Started

1.1 About this Document

Use

This Administrator's Guide is the central starting point for the technical implementation of SAP Management of Change.

Use the Administrator's Guide to get an overview of SAP Management of Change, its software units, and its processes from a technical perspective. The Administrator's Guide is a planning tool that helps you to design your SAP Management of Change system landscape. It refers you to the required detailed documentation.

This Administrator's Guide is a single source of information for the documentation that is available to support the installation and operation of SAP Management of Change. Therefore, this Administrator's Guide contains all of the following:

● Planning InformationThe first two chapters of the Administrator's Guide provide you with the most important information regarding the implementation of SAP Management of Change including an overview of the related planning information, its software units, the system landscape and the overall implementation sequence.

● Installation InformationThis chapter gives you an overview of the installation components and the sequence in which they are installed using transaction SAINT as described in detail in the Installation Notes 1651309 and 1653502 .

● Operation InformationThis chapter provides you with the most relevant information needed for the operation of SAP Management of Change.

● Security InformationThis chapter provides you with the information that you require to operate SAP Management of Change securely.

Constraints

This Administrator's Guide primarily discusses the overall technical implementation of SAP Management of Change, rather than its subordinate components. This means that additional software dependencies might exist without being mentioned explicitly in this document.

NoteYou can find the most current information about the technical implementation of SAP Management of Change and the latest installation and configuration guides on SAP Service Marketplace at http://service.sap.com/instguides .

We strongly recommend that you use the documents available here. The guides are regularly updated.

SAP Management of Change (powered by SAP NetWeaver)Getting Started C U S T O M E R 5

1.2 Related Information

Planning Information

For more information on planning topics not covered in this guide, see the following content on SAP Service Marketplace:

Table 1:

Content Location on SAP Service Marketplace

Latest versions of installation and upgrade guides http://service.sap.com/instguides

Documentation on SAP Help Portal http://help.sap.com/managementofchange

SAP Business Maps – information about applications/solu­tions and business scenarios

http://service.sap.com/businessmaps

Sizing, calculation of hardware requirements – such as CPU, disk and memory resource – with the Quick Sizer tool

http://service.sap.com/quicksizer

Released platforms and technology-related topics, such as maintenance strategies and language support

http://service.sap.com/platforms

To access the Platform Availability Matrix directly, enter http://service.sap.com/pam

Network security http://service.sap.com/securityguide

High Availability http://www.sdn.sap.com/irj/sdn/ha

Performance http://service.sap.com/performance

Support Package Stacks, latest software versions and patch level requirements

http://service.sap.com/sp-stacks

Unicode technology http://www.sdn.sap.com/irj/sdn/nw-products

Installation of SAP NetWeaver http://service.sap.com/instguidesnw

6 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Getting Started

Further Useful Links

The following table lists further useful links on SAP Service Marketplace:

Table 2:

Content Location on SAP Service Marketplace

Information about creating error messages http://service.sap.com/message

SAP Notes search http://service.sap.com/notes

SAP Software Distribution Center (software download and or­dering of software)

http://service.sap.com/swdc

SAP Online Knowledge Products (OKPs) – role-specific Learn­ing Maps

http://service.sap.com/rkt

Information about license auditing http://service.sap.com/licenseauditing

Related Master Guides

This Administrator's Guide is based on Component Master Guides. You can find more information about the relevant solutions in the following documents:

Table 3:

Title Location

SAP NetWeaver 7.0 http://service.sap.com/installNW70

SAP ERP 6.0 http://service.sap.com/erp-inst SAP ERP 6.0

Planning

SAP Enhancement Packages for SAP ERP 6.0 http://service.sap.com/erp-inst SAP ERP 6.0 SAP

enhancement package for SAP ERP 6.0

SAP Solution Manager

SAP provides the SAP Solution Manager as a platform to efficiently support the implementation of your solution. Using SAP Solution Manager significantly accelerates the implementation process and helps you to achieve your business goals. At the same time, SAP can deliver Support Services based on the business scenarios designed and documented in SAP Solution Manager. Implementation content for your solution may further accelerate the implementation process. For information about availability of content specifically tailored to your solution, see SAP Service Marketplace at http://service.sap.com/solutionmanager .

SAP Management of Change (powered by SAP NetWeaver)Getting Started C U S T O M E R 7

1.3 Important SAP Notes

You must read the following SAP Notes before you start the installation. These SAP Notes contain the most recent information on the installation, as well as corrections to the installation documentation.

Make sure that you have the up-to-date version of each SAP Note, which you can find on SAP Service Marketplace at http://service.sap.com/notes .

Table 4:

SAP Note Number Title Description

1704387 SAP Management of Change 1.0: Release Information Note

Provides a complete overview of all notes for SAP Management of Change. Check which notes may be relevant for you.

1653529 Overview: Notes on addon IAM Release planning information

1651310 Overview: Notes on addon SAP Manage­ment of Change

Release planning information

1640939 Release strategy for IAM Release planning information

1648660 Release strategy for SAP Management of Change

Release planning information

1653502 Installation of addon IAM 100 on NW 731 Installation information

1651309 Installation of addon MOC 100 on NW 731

Installation information

1738685 SAP Management of Change 1.0 - Availa­ble SAP Library

Documentation information

1738686 SAP Management of Change 1.0 - Install SAP Library documentation

Documentation installation information

1782764 SAP Management of Change 1.0 - Docu­mentation Corrections

Documentation correction information

1645996 EAM: Setting of user status for PM ob­jects (optional)

The SAP Management of Change appli­cation enables integration with EAM ob­jects. To set the user status for EAM ob­ject from the SAP Management of Change application, an RFC-enabled function module is required. The note enables you to implement the new func­tion and provides downport descriptions for the releases ECC 6.0 EhP5 to ECC 6.0.

8 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Getting Started

2 SAP Management of Change Overview

2.1 Introduction to SAP Management of Change

The SAP Management of Change application provides a highly flexible and fully auditable tool for monitoring, implementing, and reporting changes:

You can:

● Manage and streamline changes to products, procedures, processes, and equipment● Motivate employees to communicate change requests using the intuitive user interface● Monitor and organize reviews, approvals and other actions necessary to implement the change (for example,

update documentation, training materials, master data)● Use customized templates to decrease implementation and adoption costs● Ensure employees follow company/industry-specific change procedures to ensure safety compliance and

reduce incidents

2.2 System Landscape

The following section shows ways in which you can set up the system landscape for SAP Management of Change.

Management of Change as a Standalone System

The business process detailed in this guide under Business Process for SAP Management of Change uses the following system landscape.

SAP Management of Change (powered by SAP NetWeaver)SAP Management of Change Overview C U S T O M E R 9

Figure 1: Management of Change as a Standalone System

10 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

SAP Management of Change Overview

Management of Change with Existing ERP System

Figure 2: Management of Change with Existing ERP System

CautionWe strongly recommend that you use a minimal system landscape for test and demo purposes only. For performance, scalability, high availability, and security reasons, do not use a minimal system landscape as your production landscape.

For more information about the necessary installation steps, see section Installation Information in this guide.

For more information about the integration possibilities with SAP Management of Change see SAP Library for SAP Management of Change on SAP Help Portal at http://help.sap.com/managementofchange .

For an overview of the required and optional software units, see Software Units of SAP Management of Change in this guide.

SAP Management of Change (powered by SAP NetWeaver)SAP Management of Change Overview C U S T O M E R 11

2.3 Software Units of SAP Management of Change

2.3.1 Application Components

The following table gives you an overview of the application components required for the business process detailed in this guide:

Table 5:

Type of Component Component

Software Component SAP Netweaver AS ABAP 731

Software Component SAP Business Suite Foundation on SAP_BS_FND 731

Software Component SAP Issue and Activity Management

IAM 100

Software Component SAP Management of Change

MOC 100

You can use all databases and operating systems supported by SAP NetWeaver Application Server ABAP. For more information about supported platforms, see SAP Service Marketplace at http://servicesap.com/platforms .

SAP ERP

It is possible to implement SAP Management of Change as an add-on with an existing ERP system. This guide does not provide an example of a business process using SAP Management of Change with an existing SAP ERP system. However for information about the SAP enhancement packages for SAP ERP that are relevant for a potential business process that you want to implement, see SAP Service Marketplace at http://service.sap.com/erp-inst .

For more information about integration with SAP ERP, see SAP Library for SAP Management of Change on SAP Help Portal at http://help.sap.com/managementofchange .

Enterprise Services

You can create a change request using the Enterprise Service ChangeRequestCreateRequestConfirmation_In.

For more information about this Enterprise Service, see SAP Library for SAP Management of Change on SAP Help Portal at http://help.sap.com/managementofchange .

12 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

SAP Management of Change Overview

2.3.2 Technology Components

2.3.2.1 Introduction

SAP Management of Change uses the following technology components.

2.3.2.2 SAP NetWeaver Application Server

SAP NetWeaver Application Server (SAP NetWeaver AS) is the application platform for SAP NetWeaver and SAP Management of Change. It provides the technological foundation for all other SAP components.

SAP NetWeaver AS provides a platform for developing and deploying dynamic and collaborative Web applications or other thin-client applications (WAP, PDA, and so on) and includes all proven SAP programming models and technologies. With SAP NetWeaver AS, SAP supports open Internet standards, including such protocols as HTTP, HTTPS, and SMTP, as well as Internet document standards like HTML and XML.

Open integration capabilities provide access to existing SAP and non-SAP applications. All integration facilities supported by SAP are available with SAP NetWeaver AS. The Java Connector or the DCOM Connector give ABAP applications access to Java or .NET components and the other way round. In addition, the Internet Communication Framework (ICF) of SAP NetWeaver AS enables programs written in ABAP to process and distribute HTTP requests directly.

As a consequence, SAP NetWeaver AS can serve both as an HTTP server and client. It serves as an HTTP server for bringing applications to the user via a Web browser either directly or via a standard Web server. It serves as an HTTP client to access other Web applications for collecting information and data.

To complete Web connectivity, SAP NetWeaver AS provides full support for sending and receiving e-mails via SMTP.

2.3.3 SAP NetWeaver Process Integration

Based on a native Web infrastructure that leverages open standards, SAP NetWeaver Process Integration makes it possible to manage the broad diversity of highly heterogeneous components from a multitude of vendors and to run in various technology environments. The integration capabilities capture shared business semantics and act as a mediator between the services and their technical implementations. It includes technical functions, such as Web service discovery, queuing, mapping, and routing. It also establishes an infrastructure for business process management and high-performance execution within and across organizational boundaries.

Exchange-based process integration removes the problems of direct connections by extracting shared collaboration knowledge. These shared business semantics ease the integration of both external and internal components. Instead of directly coding point-to-point interfaces for each new component, the exchange infrastructure allows you to instantly plug in of new components once for each component. This provides the flexibility you needed in today’s fast-changing business world, and it reduces integration costs compared to the direct connection approach.

SAP Management of Change (powered by SAP NetWeaver)SAP Management of Change Overview C U S T O M E R 13

2.3.4 SAP Business Suite Foundation

SAP Management of Change uses the Floor Plan Manager of the SAP Business Suite Foundation.

2.4 Business Process for SAP Management of Change

Use

The following table provides an overview of a typical change process:

Table 6:

Activity By Whom Tasks

Create change request Reporter ● Describe the change● Add related attachments● Fill out customizable questionnaires

Carry out initial review Supervisor, manager, reviewer ● Check completeness of the change request

● Edit request to improve input● Decide viability of the change re­

quest● Approve submission of the change

request

Approve change request Approver ● Check completeness of the change request

● Edit the change request to improve input

● Decide if the change request is rele­vant for the process

● Reject the change request if it is not relevant

Drive change request Coordinator ● Release the change request● Define an appropriate activity hier­

archy, timelines and activity owners● Trigger activities in the defined se­

quence● Monitor the change request● Close the change request when all

activities are completed

14 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

SAP Management of Change Overview

Activity By Whom Tasks

Execute activities Activity owner (approver, reviewer) Execute activities by teams or individu­als, for example, reviews, approvals using checklists or questionnaires

More Information

You can find more information about these individual process steps and their configuration in the SAP Library for SAP Management of Change on SAP Help Portal at http://help.sap.com/managementofchange .

SAP Management of Change (powered by SAP NetWeaver)SAP Management of Change Overview C U S T O M E R 15

3 Installation Information

3.1 Introduction

This chapter gives you an overview of the installation process and the required and optional component versions relevant to SAP Management of Change.

3.2 Software Components

Use

You need to install the stated versions of the following components:

Prerequisites

● Software Component NW (SAP_BASIS, SAP ABA) 731 SP04● Software Component MDG_FND 731 SP03● Software Component WEBCUIF 731 SP03● Software Component SAP_BS_FND 731 SP03● Software Component IAM 100 SP00● Software Component MOC 100 SP00

NoteFor the latest component version and patch level requirements, as well as more detailed information about the installation process for SAP Management of Change, see Installation Notes 1651309 and 1653502 .

For an overview of all notes relevant for SAP Management of Change, see the Release Information Note 1704387.

16 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Installation Information

The installation of the following components is optional:

Table 7:

Software Component Remarks/Subsequent Steps

SAP enhancement package 6 for SAP ERP 6.0 on the SAP ECC server

Only relevant if you want to use SAP Management of Change with an existing SAP ERP system.

See also SAP Note 1645996 .

XI Content for SAP Management of Change Only relevant if you want to use enterprise service ChangeRequestCreateRequestConfirmation_In. Import the downloaded XI content files as described in SAP Note 836200 (SAP NetWeaver 7.0: Importing Process Integration Content), 1152640 (SAP NetWeaver 7.1 including EHPs: Importing ESR content), or 1574235 (SAP NetWeaver 7.3: Import of ESR content).

Download the XI content for SAP Management of Change from SAP Service Marketplace at http://service.sap.com/swdc

SAP Software Download Center Support Packages and

Patches Browse our Download Catalog SAP Application

Components SAP Management of Change .

SAP Management of Change (powered by SAP NetWeaver)Installation Information C U S T O M E R 17

4 Operation Information

4.1 Introduction

This chapter provides you with the most important information regarding the operation of SAP Management of Change.

4.2 Monitoring of SAP Management of Change

4.2.1 Introduction

Within the management of SAP Technology, monitoring is an essential task. You can find more information about the underlying technology in the SAP NetWeaver Technical Operations Manual on SAP Help Portal at http://help.sap.com/nw703 (SAP NetWeaver 7.0 (including Enhancement Package 3)) System Administration and Maintenance Information English Technical Operations Manual for SAP NetWeaver

4.2.2 Alert Monitoring

Proactive, automated monitoring is the basis for ensuring reliable operations for your SAP system environment. SAP provides you with the infrastructure and recommendations needed to set up your alert monitoring to recognize critical situations for SAP Management of Change as quickly as possible.

SAP Management of Change does not offer specific data in the Computer Center Management System (CCMS) for alert monitoring. Nevertheless general monitoring options can be used.

4.2.3 Monitoring Installation and Setup

In order to enable the auto-alert mechanism of the Computing Center Management System (CCMS), see SAP Note 617547 . SAP Management of Change is technically based on SAP NetWeaver 7.0 including enhancement package 3 and can thus reuse monitoring tools from SAP NetWeaver such as the CCMS. For more information about setting up CCMS monitoring, see the Technical Operations Manual for SAP NetWeaver on SAP Help Portal at http://help.sap.com/nw703 (SAP NetWeaver 7.0 (including Enhancement Package 3)) System Administration and Maintenance Information English Technical Operations for SAP NetWeaver Administration of SAP NetWeaver Systems Application Server ABAP (AS ABAP) Monitoring and Administration Tools for Application Server ABAP

18 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Operation Information

4.2.4 Detailed Monitoring and Tools for Problem and Performance Analysis

4.2.4.1 Introduction

SAP Management of Change is technically based on SAP NetWeaver 7.03. For information about technical problem analysis (such as for database, operating system, or workload analysis), see the Technical Operations Manual for SAP NetWeaver on SAP Help Portal at http://help.sap.com/nw703 (SAP NetWeaver 7.0 (including Enhancement Package 3)) System Administration and Maintenance Information English Technical Operations Manual for SAP NetWeaver Administration of SAP NetWeaver Systems Application Server ABAP (AS ABAP) Monitoring and Administration Tools for Application Server ABAP .

4.2.4.2 Trace and Log Files

Trace files and log files are essential for analyzing problems. The standard SAP NetWeaver tools such as transactions ST22 (for the display of ABAP runtime errors) and SM21 (for the display of system logs) can be used to monitor trace and log files.

For more information, see the Technical Operations Manual for SAP NetWeaver on SAP Help Portal at http://help.sap.com/nw703 (SAP NetWeaver 7.0 (including Enhancement Package 3)) System Administration and Maintenance Information English Technical Operations Manual for SAP NetWeaver Administration of SAP NetWeaver Systems Application Server ABAP (AS ABAP) Monitoring and Administration Tools for Application Server ABAP .

Additionally, SAP Management of Change uses the application log (part of SAP NetWeaver) to store application error, warning, and success messages issued in critical processes or in UI transactions. For general information on application logs, see SAP Help Portal at http://help.sap.com/nw703 (SAP NetWeaver 7.0 (including Enhancement Package 3)). In SAP Library choose Application Help Function-Oriented View English SAP NetWeaver by Key Capability Solution Life Cycle Management by Key Capability Application Log – (BC-SRV-BAL) . You can monitor the application logs with transaction SLG1.

Application Logs in SAP Management of Change

The following application log entities are relevant for SAP Management of Change

SAP Management of Change (powered by SAP NetWeaver)Operation Information C U S T O M E R 19

Table 8:

Application Log Object Subobject Use

/IAM/COMMON CATEGORY In transaction SLG1 you can display messages resulting from access to refer­ence objects using certain object catego­ries. Change requests and activities have object references with categories de­fined in the SAP Issue and Activity Man­agement layer, for example, FL_ERP (functional location in ERP), DOC_ERP (document in ERP).

/IAM/COMMON GTYPE_ACCESS In transaction SLG1 you can display messages resulting from access to refer­ence objects using certain object types. Change requests and activities have ob­ject references with object types defined in the IAM layer, for example EQ (equip­ment), FL (functional location).

Change Issue Issue In transaction DSLOG you can display the application log for digital signatures.

Change Activity Activity In transaction DSLOG you can display the application log for digital signatures.

Workflow Event Queues and Traces

SAP Management of Change triggers SAP business workflow events. In order to monitor them and to find and analyze any problems related to such events, the tools for SAP business workflow event queue administration (transaction SWEQADM) and browsing can be used. The workflow events relevant for SAP Management of Change can be found via the following object types:

● For events related to change requests /MOC/CL_ISSUE_WF_CONNECT● For events related to activities /MOC/CL_ACTIVITY_WF_CONNECT

4.2.4.3 Other Important Problem Analysis and Monitoring Tools

Use

BRFplus Traces

20 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Operation Information

SAP Management of Change supports the use of SAP Business Rule Framework plus (BRFplus) to:

● Determine business partners for change requests and activities.● Determine additional activities for change requests using change request information and question codes.● Find experts for certain change request types.

It is not recommended to activate these BRFplus traces for long periods of time as they are performance critical.

Procedure

Trace data can be found in the BRFplus Workbench as follows:

1. Start transaction BRF+ to open the BRFplus Workbench.

2. Switch to expert mode by choosing Personalize User mode .3. In the Tools menu choose Lean Trace.4. Find/name the required BRFplus function using the given selection data.5. Start the search to see any trace data if available.

4.2.4.4 Workload Monitors

SAP Management of Change uses the standard tools available in SAP NetWeaver 7.0 (including Enhancement Package 3) and does not require a component-specific tool. For more information, see the Technical Operations Manual for SAP NetWeaver on SAP Help Portal at http://help.sap.com/nw703 (SAP NetWeaver 7.0 (including Enhancement Package 3)) System Administration and Maintenance Information English Technical Operations Manual for SAP NetWeaver .

4.3 Management of SAP Management of Change

4.3.1 Introduction

SAP provides you with infrastructure to help your technical support consultants and system administrators effectively manage all SAP components and complete all tasks related to technical administration and operation.

4.3.2 Software Configuration

This chapter explains which application components or business processes used by this application are configurable and which tools are available for adjusting.

SAP Management of Change (powered by SAP NetWeaver)Operation Information C U S T O M E R 21

The Implementation Guide (IMG) is the standard SAP tool for component Customizing. To display the implementation Guide (IMG) on the SAP Easy Access screen choose Tools Customizing IMG Execute Project (transaction SPRO).

Customizing settings for SAP Management of Change can be found under Cross—Application ComponentsManagement of Change

Master data settings can be found on the SAP Easy Access screen under Cross—Application ComponentsManagement of Change

For more information on the typical business process for SAP Management of change, see SAP Management of Change Overview [page 9].

4.3.3 Business Configuration Sets (BC Sets)

Use

We deliver example Customizing for change requests types and number ranges with the following BC Sets:

● /MOC/EXAMPLE_CUSTOMIZING – Example Customizing - Change Request Type (hierarchical)● /IAM/OBJECT_ACCESS – Default Customizing for Define Object Access

You can activate these BC Sets along with their sub-BC Sets using transaction SCPR3.

For more information about BC Sets, see SAP Library for SAP NetWeaver on SAP Help Portal at http://help.sap.com/nw703 (SAP NetWeaver 7.0 Including Enhancement Package 3) under the term 'Business Configuration Sets (BC-CUS)'. Ensure the documentation is for SAP NetWeaver 7.0 Including Enhancement Package 3.

Prerequisites

Before activating the BC Set /MOC/EXAMPLE_CUSTOMIZING you must define the number range interval 01 for change requests and activities.

4.3.4 Administration Tools

The following table lists the tools that are especially relevant to SAP Management of Change and its components.

22 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Operation Information

Table 9:

Software Component Transaction/Tool Detailed Description

SAP_BS_FND Business Object Processing Framework (BOPF)

Transaction /BOPF/CUST_UI

Customization UI for BOPF for analysis and enhancements of the structure/defi-nition of business objects. For more in­formation, see SAP Note 1457235 .

Business Object Processing Framework (BOPF)

Transaction /BOPF/TEST_UI

Test UI for BOPF for analysis and change to the runtime data stored in business objects.

SAP_BASIS Personal Object Worklist Library (POWL)

POWL_ADMIN_COCKPIT (report)

This report is a single point of entry to perform different administrator activities relevant for POWL development, Cus­tomizing, and testing.

For more information about the reports relevant for POWL, see http://

help.sap.com SAP Personal Object

Worklist Library

SAP_ABA SAP Business Rules Framework Plus

Transaction BRF+

You can carry out more complex busi­ness partner determination, activity de­termination, and expert determination using Business Rule Framework plus (BRFplus). In the BRFplus decision ta­bles you enter parameters, for example, change request type, activity type, plant, country, duration of change, to search more specifically for additional business partners.

IAM 100 /IAM/BPUSER (report /IAM/APP_CREATE_BUPA)

This report supports you in creating business partners for the system users, for example, that you have imported from an external system.

SAP Management of Change and the underlying components are all technically based on SAP NetWeaver. For information about the relevant administration tools, see the Technical Operations Manual for SAP NetWeaver on SAP Help Portal at http://help.sap.com/nw703 . In SAP Library choose SAP NetWeaver Administrator’s Guide Technical Operations for SAP NetWeaver .

SAP Management of Change (powered by SAP NetWeaver)Operation Information C U S T O M E R 23

4.3.5 Backup and Restore

You need to back up your system landscape regularly to ensure that you can restore and recover it in case of failure. The backup and restore strategy for SAP Management of Change consists of two parts:

● Backup and restore coverage for each component● Cross-system data dependencies and handling

The backup and restore strategy for your system landscape should not only consider SAP systems but should also be embedded in overall business requirements and incorporate your company’s entire process flow. In addition, the backup and restore strategy must cover disaster recovery processes, such as the loss of a data center through fire. It is most important in this context that you ensure that backup devices are not lost together with normal data storage (separation of storage locations). Based on the type of application data contained in a component, a categorization scheme for system components can be used to analyze the backup requirements of any system component and to easily determine an appropriate backup method for this component. For more information, see the best practices document Backup and Restore at http://service.sap.com/bp-roadmap Operations Implementation Backup and Restore for mySAP

For more information, see also Categories of System Components for Backup and Restore.

4.3.6 User Management

SAP Management of Change uses the standard functionality of SAP NetWeaver for the user management, such as creating users with transaction SU01 and creating and using roles with transaction PFCG. For more information about SAP NetWeaver, see SAP Help Portal at http://help.sap.com/nw703 Application Help SAP LibraryEnglish SAP NetWeaver .

For an overview of the information necessary for operating SAP NetWeaver Identity Management, see the Identity Center - Operations Guide available on SAP Help Portal at http://help.sap.com/nw703 SAP NetWeaver Identity Management 7.03 .

4.3.7 Printing

SAP Management of Change uses the standard functionality of NetWeaver for printing PDF forms using Adobe. For more information about SAP NetWeaver, see http://help.sap.com/nw703 (SAP NetWeaver 7.03 (including Enhancement Package 3)) Application Help SAP Library English SAP NetWeaver .

24 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Operation Information

4.4 Software Change Management

4.4.1 Introduction

Software Change Management standardizes and automates software distribution, maintenance, and testing procedures for complex software landscapes and multiple software development platforms. These functions support your project teams, development teams, and application support teams. The goal of Software Change Management is to establish consistent, solution-wide change management that allows for specific maintenance procedures, global rollouts (including localizations), and open integration with third-party products. This section provides additional information about the most important software components. The following topics are covered:

● Transport and Change Management - Enables and secures the distribution of software changes from the development environment to the quality assurance and production environment.

● Development Request and Development Release Management – Enables customer-specific maintenance procedures and open integration with third-party products.

● Quality Management and Test Management - Reduce the time, cost, and risk associated with software changes.

● Support Packages and SAP Notes Implementation – Provide standardized software distribution and maintenance procedures.

4.4.2 Transport and Change Management

All components of SAP Management of Change are client-enabled. For transport and change management issues, the procedures of SAP NetWeaver apply. For information, see the Technical Operations Manual for SAP NetWeaver on SAP Help Portal at http://help.sap.com/nw703 . In SAP Library choose SAP NetWeaver Administrator’s Guide Technical Operations for SAP NetWeaver .

4.4.3 Development Requests and Development Release Management

The standard procedures of SAP NetWeaver apply. See the Technical Operations Manual for SAP NetWeaver on SAP Help Portal under SAP NetWeaver.

4.4.4 Support Packages and Patch Implementation

We recommend that you implement Support Package Stacks (SP-Stacks), which are sets of support packages and patches for the respective product version that must be used in the given combination. The technology for applying support packages and patches will not change.

Read the corresponding Release and Information Notes (RIN) before you apply any support packages or patches of the selected SP Stack. Use the Maintenance Optimizer (transaction DSWP) of the SAP Solution Manager to

SAP Management of Change (powered by SAP NetWeaver)Operation Information C U S T O M E R 25

select, download, and install the needed usages, or software components and required support packages. For more information, see the following:

● SAP Solution Manager documentation on SAP Help Portal at http://help.sap.com SAP Solution ManagerChange Management Maintenance Optimizer

● SAP Service Marketplace at http://service.sap.com/solman-mopz● The documentation for transaction SAINT (SAP Add-On Installation Tool)

For more information about the implementation of support packages as well as possible side effects, see http://service.sap.com/patches SAP Support Packages in Detail.

For more information about the tools necessary for implementing patches, see SAP NetWeaver documentation.

4.5 Troubleshooting

4.5.1 Troubleshooting the Process Foundation

Since the process foundation is responsible for implementing your business processes in the system, it may be directly related to problems or problems can be found by analyzing the information available through it.

4.6 Support Desk Management

4.6.1 Introduction

Support Desk Management enables you to set up an efficient internal support desk for your support organization that seamlessly integrates your end users, internal support employees, partners, and SAP Active Global Support specialists with an efficient problem resolution procedure.

For support desk management, you need the methodology, management procedures, and tools infrastructure to run your internal support organization efficiently.

The following topics are covered:

● Remote Support● Component hierarchy relevant for this application

4.6.2 Remote Support Setup

SAP support needs to be able to work remotely for highest efficiency and availability. Therefore all required support tools must be remotely accessible for SAP support.

26 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Operation Information

For SAP Management of Change, the standard SAP procedures for setting up remote support apply. For information about Remote Support Setup, see SAP Service Marketplace at http://service.sap.com/access-support

.

The application-specific read-only role SAP_MOC_SUPPORT can be assigned to users working in remote support. This provides read-only access for checking logs and analyzing data. It is not possible to change existing data or create new data in the customer system.

4.6.3 Problem Message Handover

For information about processing internal support messages and forwarding them to SAP, see SAP Help Portal at http://help.sap.com SAP Solution Manager SAP Solution Manager 7.0 SP34 English Service Desk . To send problem messages or tickets to SAP, choose the appropriate component (or subcomponent) name from the SAP component hierarchy: CA-IAM-MOC.

SAP Management of Change (powered by SAP NetWeaver)Operation Information C U S T O M E R 27

5 Security Information

5.1 Introduction

This chapter of the Administrator's Guide provides an overview of the security-relevant information that applies to SAP Management of Change.

5.2 Before You Start

Fundamental Security Guides

SAP Management of Change can be deployed as standalone solution based on SAP NetWeaver 7.0 including enhancement package 3. SAP Management of Change can also be connected to other applications, for example, SAP ERP Central Component (SAP ECC). Therefore, the corresponding Security Guides also apply to SAP Management of Change. Pay particular attention to the most relevant sections or specific restrictions as indicated in the table below.

Table 10: Fundamental Security Guides

Scenario, Application, or Component Security Guide Most-Relevant Sections or Specific Restrictions

SAP NetWeaver 7.0 EhP3 Security Guide http://service.sap.com/securityguide SAP NetWeaver

SAP NetWeaver 7.0 (2004s) SAP NetWeaver 7.0 EhP3

Security Guide (Online Version)

SAP NetWeaver Identity Management Security Information http://help.sap.com/nw703 SAP Library SAP

NetWeaver SAP NetWeaver by Key Capability Security

Identity Management

SAP Web Application Server ● SAP Web AS Security Guide for ABAP Technology● Internet Transaction Server Security Aspects in Develop­

ment

SAP ERP Security Guide http://service.sap.com/securityguide SAP Business

Suite Applications SAP ERP for example, 6.0

For a complete list of the available SAP Security Guides, see http://service.sap.com/securityguide on the SAP Service Marketplace.

28 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

Important SAP Notes

The most important SAP Notes that apply to the security of the SAP Management of Change application are shown in the table below.

Table 11: Important SAP Notes

SAP Note Number Title Comment

Not relevant for this release Not relevant for this release Not relevant for this release

In addition, you can find a list of security-relevant SAP Hot News and SAP Notes on the SAP Service Marketplace at https://service.sap.com/securitynotes .

Additional Information

For more information about specific topics, see the Quick Links as shown in the table below.

Table 12: Quick Links to Additional Information

Content Quick Link on the SAP Service Marketplace or SDN

Security http://sdn.sap.com/irj/sdn/security

Security Guides https://service.sap.com/securityguide

Related SAP Notes https://service.sap.com/notes

https://service.sap.com/securitynotes

Released Platforms https://service.sap.com/pam

Network Security https://service.sap.com/securityguide

SAP Solution Manager https://service.sap.com/solutionmanager

SAP NetWeaver http://sdn.sap.com/irj/sdn/netweaver

Application Help https://help.sap.com/managementofchange

5.3 Technical System Landscape

For more information about the technical system landscape, see the resources listed in the table below and System Landscape [page 9].

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 29

Table 13: More Information About the Technical System Landscape

Topic Guide/Tool Quick Link to the SAP Service Market­place or SDN

Technical description of the underlying technological components such as SAP NetWeaver.

Administrator's Guide https://service.sap.com/instguides

High availability High Availability for SAP Solutions http://sdn.sap.com/irj/sdn/ha

Technical landscape design See applicable documents http://sdn.sap.com/irj/sdn/landscape­design

Security See applicable documents https://service.sap.com/security

5.4 User Administration and Authentication

5.4.1 Introduction

The SAP Management of Change application uses the user management and authentication mechanisms provided with the SAP NetWeaver platform, in particular the SAP NetWeaver Application Server. Therefore, the security recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver Application Server ABAP Security Guide also apply to the SAP Management of Change application.

In addition to these guidelines, we include information about user administration and authentication that specifically applies to the SAP Management of Change application in the following topics:

● User ManagementThis topic lists the tools to use for user management, the types of users required, and the standard users that are delivered with the SAP Management of Change application.

● User Data SynchronizationThe SAP Management of Change application shares user data with [list sources]. This topic describes how the user data is synchronized with these other sources.

● Integration Into Single Sign-On EnvironmentsThis topic describes how the SAP Management of Change application supports Single Sign-On mechanisms.

5.4.2 User Management

User management for the SAP Management of Change application uses the mechanisms provided by the SAP NetWeaver AS ABAP, for example, tools, user types, and password policies. For an overview of how these mechanisms apply for the SAP Management of Change application, see the sections below. In addition, we provide a list of the standard users required for operating the SAP Management of Change application.

30 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

User Administration Tools

The table below shows the tools to use for user management and user administration with the SAP Management of Change application.

Table 14: User Management Tools

Tool Description

User maintenance for ABAP-based systems (transaction SU01)

For more information on the authorization objects provided by the subcomponents of the SAP Management of Change appli­cation, see the relevant component in the section Authorizations.

Role maintenance with the profile generator for ABAP-based systems (PFCG)

For more information on the roles provided by the subcompo­nents of SAP Management of Change, see the relevant compo­nent in the section Authorizations. For more information, see User and Role Administration of Application Server ABAP

Central User Administration (CUA) for the maintenance of multiple ABAP-based systems

Use the CUA to centrally maintain users for multiple ABAP-based systems. Synchronization with a directory server is also supported.

Report /IAM/APP_CREATE_BUPA This report supports you in creating business partners for the system users, for example, that you have imported from an ex­ternal system.

User Types

It is often necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively have to change their passwords on a regular basis, but not those users under which background processing jobs run.

The user types that are required for the SAP Management of Change application include:

● Individual users:○ Dialog users are used for SAP GUI for Windows○ Internet users for Web applications

Same policies apply as for dialog users, but used for Internet connections.

● Technical users:○ Communication users are used for dialog-free communication between systems.○ Service users are dialog users who are available for a large set of anonymous users (for example, for

anonymous system access via an ITS service). Not required for SAP Management of Change.○ Background users are not required for SAP Management of Change..

For more information on these user types, see User Types in the SAP NetWeaver Application Server ABAP Security Guide.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 31

Standard Users

The table below shows the standard users that are necessary for operating the SAP Management of Change application.

Table 15: Standard Users

System User Type Password Description

System where SAP Management of Change is installed and systems SAP Manage­ment of Change is con­nected to

<User 1> Dialog user You specify the initial password during the in­stallation.

The main users for SAP Management of Change.

Required for the SAP Management of Change application (if NWBC for Desktop is intended to be used).

Required in the SAP Management of Change system to make Customizing set­tings, create and ac­cess master data, in the system itself and in other systems con­nected to SAP Manage­ment of Change.

System where SAP Management of Change is installed

<User 2> Internet user You specify the initial password during the in­stallation.

If it is intended to use NWBC for HTML, then this kind of user is needed for the SAP Management of Change application in addition to the dialog user.

System where SAP Management of Change is installed and systems SAP Manage­ment of Change is con­nected to

<User 3> Communication user The user ID and pass­word are stored in the RFC destination for the connection.

To read detail informa­tion from the SAP Man­agement of Change system, for example, master data in the sys­tem itself or in other systems such as SAP ERP that are connected to the SAP Manage­ment of Change sys­tem.

32 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

5.4.3 User Data Synchronization

By synchronizing user data, you can reduce effort and expense in the user management of your system landscape. Since SAP Management of Change is based on SAP NetWeaver, you can use all of the mechanisms for user synchronization in SAP NetWeaver here. For more information, see the SAP NetWeaver Security Guide on SAP Service Marketplace at http://service.sap.com/securityguide SAP NetWeaver

ExampleYou can use user data distributed across systems by replicating the data, for example in a central directory such as LDAP.

5.4.4 Integration Into Single Sign-On Environments

The SAP Management of Change application supports the Single Sign-On (SSO) mechanisms provided by the SAP NetWeaver Application Server for ABAP technology. Therefore the security recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver Security Guide also apply to the SAP Management of Change application.

The most widely-used supported mechanisms are listed below.

● Secure Network Communications (SNC)SNC is available for user authentication and provides for an SSO environment when using the SAP GUI for Windows or Remote Function Calls.

● SAP logon ticketsThe SAP Management of Change application supports the use of logon tickets for SSO when using a Web browser as the frontend client. In this case, users can be issued a logon ticket after they have authenticated themselves with the initial SAP system. The ticket can then be submitted to other systems (SAP or external systems) as an authentication token. The user does not need to enter a user ID or password for authentication but can access the system directly after the system has checked the logon ticket.

● Client certificatesAs an alternative to user authentication using a user ID and passwords, users using a Web browser as a frontend client can also provide X.509 client certificates to use for authentication. In this case, user authentication is performed on the Web server using the Secure Sockets Layer Protocol (SSL Protocol) and no passwords have to be transferred. User authorizations are valid in accordance with the authorization concept in the SAP system.

You can find more information about the available authentication mechanisms under User Authentication and Single Sign-On in the SAP NetWeaver Library.

5.5 Authorizations

The SAP Management of Change application uses the authorization provided by the SAP NetWeaver Application Server ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver Application Server ABAP Security Guide also apply to the SAP Management of Change application.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 33

The SAP NetWeaver authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the SAP NetWeaver Application Server ABAP.

Standard Roles

SAP Management of Change provides the standard roles in the table below. Before using the roles listed, you may want to check whether the delivered standard roles meet your requirements and adjust the Customizing settings in the change request type, activity type, and so on. These roles contain only the structure of the menu but no specific authorizations. These authorizations are provided by special authorization roles listed in the Authorization Roles section below.

The table below shows the standard PFCG roles that are used by the SAP Management of Change application.

Table 16: Navigational Roles

Role Description

SAP_COCKPIT_MOC_MAIN (only a structuring role, does not have authorizations assigned)

Provides you with access to all of the Management of Change applications

SAP_COCKPIT_MOC_ANALYTICS (only a structuring role, does not have authorizations assigned)

Provides you with access to analytical, statistical information.

SAP_COCKPIT_MOC_MAIN_AND_ANALY(composite role) (only a structuring role, does not have authorizations assigned)

Combination of SAP_COCKPIT_MOC_MAIN and SAP_COCKPIT_MOC_ANALYTICS. Provides you with access to all of the Management of Change applications, including ana­lytical and statistical information.

Authorization Roles

Table 17:

Authorization Role Description

SAP_AUTH_MOC_ACTIVITY_OWNER Authorization Role Activity Owner for Management of Change

SAP_AUTH_MOC_ADMIN Authorization Role Administrator for Management of Change

SAP_AUTH_MOC_APPROVER Authorization Role Approver for Management of Change

SAP_AUTH_MOC_COORDINATOR Authorization Role Coordinator for Management of Change

SAP_AUTH_MOC_REPORTER Authorization Role Reporter for Management of Change

34 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

Standard Authorization Objects

Table 18: Standard Authorization Objects

Authorization Object Description

/IAM/OREF

Authorization Object for Reference Objects for Change Re­quest and Activity

Controls if a user is allowed to create, display or delete a refer­ence object of a change request or activity.

/IAM/AAUTH

Authorization Object for Activity

Controls the action (for example create, update, delete) that a user can perform for an activity

/IAM/IAUTH

Authorization Object for Issue/Change Request

Controls the action (for example create, update, delete) a user can perform for a change request.

IAM/A_STAT

Authorization Object for Lifecycle Status (Activity)

Controls for which lifecycle statuses a user can edit an activity.

This Authorization Object exclusively controls activity 02 (Change). Other activities will not be considered in authoriza­tion checks.

IAM/I_STAT

Authorization Object for Lifecycle Status (Change Request)

Controls for which lifecycle statuses a user can edit a change request. This Authorization Object exclusively controls ac­tivity 02 (Change). Other activities will not be considered in authorization checks.

You can define that a user only has change authorization when the change request is in a certain life cycle status. If the change request is not in that life cycle status the user will not be able to access it in edit mode.

IAM/A_USTA

Authorization Object for User Status Action (Activity)

Controls which user status actions a user can perform on an activity

IAM/I_USTA

Authorization Object for User Status Action (Change Request)

Controls which user status actions a user can perform on a change request.

Additional Fields for Authorization Object /IAM/OREF

The additional fields enable ERP authorization checks to be replicated in the Management of Change system. The fields mentioned in the table are passed from the ERP object into the reference object in the Management of Change system.

These values can then be used for Management of Change authorization checks.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 35

Table 19:

Object Type Additional Field 1 (Manage­ment of Change BAPI Struc­ture Replicated from Equiva­lent ERP BAPI Structure)

Additional Field 2 (Manage­ment of Change BAPI Struc­ture Replicated from Equiva­lent ERP BAPI Structure)

Additional Field 3 (Manage­ment of Change BAPI Struc­ture Replicated from Equiva­lent ERP BAPI Structure)

Document /IAM/AUTH_GROUP (filled from the BAPI struc­ture /IAM/S_BAPI_DOC_RESULT-AUTHORITYGROUP)

n/a n/a

Equipment /IAM/AUTH_GROUP (filled from the BAPI struc­ture /IAM/S_BAPI_ITOB-AUTHGRP)

n/a n/a

Functional location /IAM/AUTH_GROUP (filled from the BAPI struc­ture /IAM/S_BAPI_ITOB-AUTHGRP)

n/a n/a

Plant /IAM/COUNTRY (filled from the BAPI structure /IAM/S_PLANT_ATTRIBUTE-COUNTRY)

/IAM/PLANT (filled from the BAPI structure /IAM/S_PLANT_ATTRIBUTE-PLANT)

n/a

Maintenance notification /IAM/PM_PHASE (filled from the BAPI structure /IAM/S_BAPI_PMNTF_RESULT-PHASE)

/IAM/PM_NOTIFICATION_TYPE (filled from the BAPI struc­ture /IAM/S_BAPI_PMNTF_RESULT-NOTIF_TYPE)

/IAM/PLANT (filled from the BAPI structure /IAM/S_BAPI_PMNTF_RESULT-PLANPLANT)

Maintenance order /IAM/PM_PHASE (filled from the BAPI structure /IAM/S_BAPI_PMORD_RESULT-PHASE)

/IAM/PM_ORDERTYPE (filled from the BAPI struc­ture /IAM/S_BAPI_PMORD_RESULT-ORDER_TYPE)

/IAM/PLANT (filled from the BAPI structure /IAM/S_BAPI_PMORD_RESULT-PLANPLANT)

5.6 Session Security Protection

To increase security and prevent access to the SAP logon ticket and security session cookie(s), it is recommended that you activate secure session management. We also highly recommend using SSL to protect the network communications where these security-relevant cookies are transferred.

36 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

Session Security Protection on the SAP Application Server (AS) ABAP

You can activate secure session management. With an existing security session, users can then start applications that require a user logon without logging on again. When a security session is ended, the system also ends all applications that are linked to this security session.

Use the transaction SICF_SESSIONS to specify the following parameter values shown in the table below in your AS ABAP system:

Session Security Protection Profile Parameters

Table 20:

Profile Parameter Recommended Value Comment

icf/set_HTTPonly_flag_on_cookies

0 Client-Dependent

login/ticket_only_by_https 1 Not Client-Dependent

5.7 Network and Communication Security

5.7.1 Introduction

Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business and your needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the backend system’s database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.

The network topology for the SAP Management of Change application is based on the topology used by the SAP NetWeaver platform. Therefore, the security guidelines and recommendations described in the SAP NetWeaver Security Guide also apply to the SAP Management of Change application. Details that specifically apply to the SAP Management of Change application are described in the following topics:

● Communication Channel SecurityThis topic describes the communication paths and protocols used by the SAP Management of Change application.

● Network SecurityThis topic describes the recommended network topology for the SAP Management of Change application. It shows the appropriate network segments for the various client and server components and where to use firewalls for access protection. It also includes a list of the ports needed to operate the SAP Management of Change application.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 37

● Communication DestinationsThis topic describes the information needed for the various communication paths, for example, which users are used for which communications.

For more information, see the following sections in the SAP NetWeaver Security Guide:

● Network and Communication Security● Security Guides for Connectivity and Interoperability Technologies

5.7.2 Communication Channel Security

The table below shows the communication paths used by the SAP Management of Change application, the protocol used for the connection, and the type of data transferred.

Table 21: Communication Paths

Communication Path Protocol Used Type of Data Transferred Data Requiring Special Pro­tection

Frontend client using SAP GUI for Windows to application server

RFC, HTTP(S) Integration data, for example, master data

Passwords

Frontend client using a Web browser to application server

HTTPS All application data Passwords, for example for digital signature

Application server to third-party application

HTTPS system ID, client, and host name

System information (that is, host name)

Application server to applica­tion server

RFC Application data (equipment, functional locations) integra­tion objects

System information

Web service client to Web service provider

SOAP XML document Personal data

DIAG and RFC connections can be protected using Secure Network Communications (SNC). HTTP connections are protected using the Secure Sockets Layer (SSL) protocol.

For more information, see Transport Layer Security the SAP NetWeaver Security Guide.

5.7.3 Network Security

Your network infrastructure plays a key role in protecting your system. A well-defined network topology can eliminate many security threats based on software flaws (at the operating system and application level) or network attacks such as eavesdropping. We offer general recommendations to protect your system landscape, based on SAP NetWeaver.

38 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

NoteFor information about network security for SAP NetWeaver, see the SAP NetWeaver Security Guide on SAP Service Marketplace at http://service.sap.com/securityguide

A minimum security demand for your network infrastructure is the use of a firewall for all your services that are provided over the Internet. A more secure variant is to protect your systems (or groups of systems) by locating the system groups in different network segments. Each system group has a firewall that protects it from unauthorized access. External security attacks can also come from the inside, if the intruder has already taken control of one of your systems.

NoteFor information about access control using firewalls, see the SAP NetWeaver Security Guide on SAP Help Portal at http://service.sap.com/securityguide SAP NetWeaver SAP NetWeaver 7.0 EhP3 Security Guides (Online Version) SAP NetWeaver Security Guide Network and Communication Security Using Firewall Systems for Access Control

5.7.4 Communication Destinations

The use of users and authorizations in an irresponsible manner can pose security risks. You should therefore follow the security rules below when communicating with other systems:

● Employ the user types system and communication.● Grant a user only the minimum authorizations.● Choose a secure password and do not divulge it to anyone else.● Only store user-specific logon data for users of type system and communication.● Wherever possible, use trusted system functions instead of user-specific logon data.

For more information about communication destinations of SAP NetWeaver 7.0, see the SAP NetWeaver Security Guide on the SAP Service Marketplace at http://service.sap.com/securityguide SAP NetWeaver SAP NetWeaver 7.0 (2004s) SAP NetWeaver 7.0 EhP3 Security Guides (Online Version) SAP NetWeaver Security Guide Security Guides for Connectivity and Interoperability Technologies .

5.8 Internet Communication Framework Security

You should only activate those services that are needed for the applications running in your system. For SAP Management of Change the following services are needed:

● default_host sap bc webdynpro moc

● default_host sap bc srt xip moc

Use the transaction SICF to activate these services.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 39

If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.

5.9 Data Storage Security

Depending on the technology you are using, you may encounter security issues when trying to display links that are not explicitly added to the whitelist. For more information about defining whitelist entries, see the SAP NetWeaver documentation at http://help.sap.com SAP NetWeaver Business Client 7 Security Aspects 7.8 Whitelist. .

5.10 Data Protection and Privacy

5.10.1 Introduction

Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy regulation, it is necessary to consider compliance with industry-specific legislation in different countries.

SAP provides specific features and functions to support compliance with regards to relevant legal requirements, including data protection. SAP does not give any advice on whether these features and functions are the best method to support company, industry, regional, or country-specific requirements. Furthermore, this information should not be taken as advice or a recommendation in regard to additional features that would be required in specific IT environments. Decisions related to data protection must be made on a case-by-case basis, taken into consideration the given system landscape and the applicable legal requirements.

NoteSAP does not provide legal advice in any form. SAP software supports data protection compliance by providing security features and specific data protection relevant functions, such as simplified blocking and deletion of personal data. In many cases, compliance with applicable data protection and privacy laws will not be covered by a product feature. Definitions and other terms used in this document are not taken from a particular legal source.

5.10.2 Glossary

40 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

Table 22:

Term Definition

Blocking A method of restricting access to data for which the primary business purpose has ended.

Business purpose A legal, contractual, or in other form justified reason for the processing of personal data. The assumption is that any pur­pose has an end that is usually already defined when the pur­pose starts.

Consent The action of the data subject confirming that the usage of his or her personal data shall be allowed for a given purpose. A consent functionality allows the storage of a consent record in relation to a specific purpose and shows if a data subject has granted, withdrawn, or denied consent.

Deletion Deletion of personal data so that the data is no longer availa­ble.

End of business Date where the business with a data subject ends, for exam­ple, the order is completed, the subscription is cancelled, or the last bill is settled.

End of purpose (EoP) End of purpose and start of blocking period. The point in time, when the primary processing purpose ends (for example, con­tract is fulfilled).

End of purpose (EoP) check A method of identifying the point in time for a data set when the processing of personal data is no longer required for the primary business purpose. After the EoP has been reached, the data is blocked and can only be accessed by users with special authorization (for example, tax auditors).

Personal data Any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by ref­erence to an identifier such as a name, an identification num­ber, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, eco­nomic, cultural, or social identity of that natural person.

Residence period The period of time between the end of business and the end of purpose (EoP) for a data set during which the data remains in the database and can be used in case of subsequent proc­esses related to the original purpose. At the end of the longest configured residence period, the data is blocked or deleted.

The residence period is part of the overall retention period.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 41

Term Definition

Retention period The period of time between the end of the last business activ­ity involving a specific object (for example, a business partner) and the deletion of the corresponding data, subject to applica­ble laws. The retention period is a combination of the resi­dence period and the blocking period.

Sensitive personal data A category of personal data that usually includes the following type of information:

● Special categories of personal data such as data revealing racial or ethnic origin, political opinions, religious or philo­sophical beliefs, or trade union membership and the proc­essing of genetic data, biometric data, data concerning health, sex life or sexual orientation or personal data con­cerning bank and credit accounts

● Personal data subject to professional secrecy● Personal data relating to criminal or administrative of­

fenses● Personal data concerning insurances and bank or credit

card accounts

Where-used check (WUC) A process designed to ensure data integrity in the case of po­tential blocking of business partner data. An application's where-used check (WUC) determines if there is any depend­ent data for a certain business partner in the database. If de­pendent data exists, this means the data is still required for business activities. Therefore, the blocking of business part­ners referenced in the data is prevented.

Some basic requirements that support data protection are often referred to as technical and organizational measures (TOM). The following topics are related to data protection and require appropriate TOMs:

● Access control: Authentication features as described in section User Administration and Authentication● Authorizations: Authorization concept as described in section Authorizations [page 33].● Transmission control: as described in section Network and Communication Security.● Input control: Change logging is described in section Enterprise Services Security [page 47].● Availability control as described in:

○ Section Data Storage Security [page 40]○ SAP NetWeaver Database Administration documentation

○ SAP Business Continuity documentation in the SAP NetWeaver Application Help under Function-Oriented View Solution Life Cycle Management SAP Business Continuity

● Separation by purpose: Is subject to the organizational model implemented and must be applied as part of the authorization concept.

CautionThe extent to which data protection is ensured depends on secure system operation. Network security, security note implementation, adequate logging of system changes, and appropriate usage of the system are the basic technical requirements for compliance with data privacy legislation and other legislation.

42 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

5.10.3 Deletion of Personal Data

When handling personal data, it is necessary to comply with general data protection regulation and industry-specific legislation in different countries. A typical requirement in certain countries and regulations is that personal data shall no longer be handled after the specified, explicit, and legitimate purpose for the processing of personal data has ended. Data that has reached its end of purpose (EoP) must be deleted if no other retention periods are defined in legislation, for example, retention periods for financial documents.

If there are legal requirements to retain personal data after the end of purpose, this data needs to be blocked. Blocked data retains in the database due to the legally defined retention periods but it can be displayed only by special persons with special authorizations.

NoteSAP Management of Change might process data (personal data) that is subject to the data protection laws applicable in specific countries as described in 1825544 .

To enable even complex scenarios of blocking and deleting data, SAP Management of Change uses SAP Information Lifecycle Management (SAP ILM) to help you set up a compliant information lifecycle management process in an efficient and flexible manner. SAP Information Lifecycle Management supports the entire software lifecycle including the storage, retention, blocking, and deletion of data.

End of Purpose Check

Before blocking and deleting personal data, an end of purpose check (EoP check) determines whether data is still relevant for business activities based on the retention period defined for the data.

The retention period of data consists of the following phases:

● Phase 1: The relevant data is actively used.● Phase 2: The relevant data is actively available in the system.● Phase 3: The relevant data needs to be retained for other reasons.: The relevant data is actively available in the

system.For example, processing of data is no longer required for the primary business purpose, but to comply with legal rules for retention, the data must still be available. In phase 3, the relevant data is blocked.

Blocking of data prevents the business users of SAP applications from displaying and using data that may include personal data and is no longer relevant for business activities.

Blocking of data can impact system behavior in the following ways:

● Display: The system does not display blocked data.● Change: It is not possible to change a business object that contains blocked data.● Create: It is not possible to create a business object that contains blocked data.● Copy/Follow-Up: The relevant data is actively available in the: It is not possible to copy a business object or

perform follow-up activities for a business object that contains blocked data.● Search: It is not possible to search for blocked data or to search for a business object using blocked data in the

search criteria.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 43

It is possible to display blocked data if a user has special authorization. However, it is still not possible to create, change, copy, or perform follow-up activities on blocked data.

SAP Management of Change registers an end of purpose check in the Customizing settings for the blocking and deletion of application data (for customer data, vendor data, and business partner data).

For more information about the Customizing of blocking and deletion for this product, see section Configuration: Simplified Blocking and Deletion.

Relevant Application Objects and Available Deletion Functionality

The following table lists the relevant application objects and the available deletion functionalities for SAP Management of Change.

Table 23: Application Objects and Available Deletion Functionalities in SAP Management of Change

Application Object Provided Deletion Functionalities

Activity Archiving object /IAM/ACT

Related ILM object IAM_ACTIVITY

Change request (issue) Archiving object /IAM/ISSUE

Related ILM object IAM_ISSUE

Process Flow: Blocking and Deletion

1. Define the retention periods in SAP Information Lifecycle Management (ILM) (transaction IRMPOL) for the ILM objects IAM_ACTIVITY and IAM_ISSUE.

2. To support the end of purpose functionality of the central business partners, carry out the following steps:○ Run transaction ILM Policies (IRMPOL) and do the following:

○ Maintain the required retention policies for the central business partner (ILM object CA_BUPA).○ Define policy rules for the application name IAM and the existing rule variants.

○ Run transaction Block Business Partners (BUPA_PRE_EOP) to enable the end of purpose check function for the central business partner.

○ Run transaction Block Customer&Supplier Master Data (CVP_PRE_EOP) to enable the end of purpose check function for the customer master and vendor master in SAP ERP.

○ Business users can request unblocking of blocked data by using transaction Business partner unblock requests (BUP_REQ_UNBLK).

○ If you have the necessary authorizations, you can unblock data by running the following transactions:○ Block Business Partners (BUPA_PRE_EOP)○ Unblock Customer&Supplier MasterData (CVP_UNBLOCK_MD)

3. Delete data by using transaction Data Destruction (ILM_DESTRUCTION) for the ILM objects IAM_ACTIVITY and IAM_ISSUE. Choose whether data deletion is required for data stored in archive files or data stored in the database.

44 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

For more information about deleting data, see the SAP ERP Library at http://help.sap.com/erp . Open the application help and go to Cross-Application Functions Cross-Application Components SAP Information Lifecycle Management Using ILM Retention Management in the Application System Destroying Data in a Live Application System Destroying Data from the Database of the Application System .

For more information about how to configure blocking and deletion for SAP Management of Change, see the section Configuration: Simplified Blocking and Deletion.

Configuration: Simplified Blocking and Deletion

SAP provides specific features and functions to support compliance with the relevant legal requirements for data protection.

Simplified blocking and deletion describes the technical process for blocking and deleting personal data in a structured and integrated manner. The functions for deleting data across specific archiving processes and blocking data using authorization-based grouping are enhanced by functions for modeling and applying blocking and deletion rules in an SAP system group.

In SAP Management of Change, you configure the settings related to the blocking and deletion of business partner master data in Customizing for Cross-Application Components under Data Protection:

● Define the settings for authorization management under Authorization Management.For more information, see the Customizing documentation.

● Define the settings for blocking in Customizing under Blocking and Unblocking Business Partner .

For more information about simplified blocking and deletion, see the product assistance at http://help.sap.com/erp . Under Application Help, open the SAP Library and go to SAP ERP Cross-Application Functions Cross-Application Components Data Protection Simplified Blocking and Deletion .

More Information

● For more information about the end of purpose check in SAP Management of Change, see the product assistance of SAP Management of Change on the SAP Help Portal at http://help.sap.com/managementofchange. Under Application Help, open the SAP Library and go to Data Protection in SAP Management of Change Business Partner End Of Purpose (EoP) Check in SAP Management of Change .

● For more information about archiving in SAP Management of Change, see the product assistance of SAP Management of Change on the SAP Help Portal at http://help.sap.com/managementofchange. Under Application Help, open the SAP Library and go to Data Archiving in SAP Management of Change.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 45

5.10.4 Information Report

In SAP Management of Change, it is possible to display all change requests and activities of a certain person. This selection is based on the business partner ID of the current user who can taylor the content of the information report to his or her needs.

You can use the following authorization objects to control the information reports for change requests and activities:

● /IAM/IAUTH (change request)● /IAM/AAUTH (activity)

To control the information report via the Worklist in SAP Management of Change, the authorization object CA_POWL needs to be assigned to the user.

More Information

For more information about displaying and configuring information reports in SAP Management of Change, see the product assistance of SAP Management of Change on the SAP Help Portal at http://help.sap.com/managementofchange. Under Application Help, open the SAP Library and go to Data Protection in SAP Management of Change Information Report .

5.10.5 Change Log

Personal data is subject to frequent changes. Therefore, for revision purposes or as a result of legal regulations, it may be necessary to track the changes that have been made to this data. When these changes are logged, you should be able to check which employee made which changes, the date and time, the previous value, and the current value. It is also possible to analyze errors in this way.

Setting Up Change Logs for SAP Management of Change

SAP Management of Change processes personal data of business partners that are involved in change requests and activities. If any changes are made regarding the business partner, the system logs the following information on personal data per change request and activity:

● The user who has changed data● Data and the time of the change● The change type (update, insert, deletion, single field documentation)● The identifying keys and their values of the data records● The heading name for the attribute that has been changed

You can define the fields to be logged under Display Change Document Objects (transaction SCDO).

46 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

You use the authorization object IAM/CHGLOG to control the change logging for change requests and activities.

Displaying Change Logs in SAP Management of Change

You can call up the change logs as follows:

● In the Worklist of SAP Management of Change, it is possible to call up a change log for each change request and and each activity.

NoteChange logs can only be displayed if the user is assigned the authorization role SAP_AUTH_MOC_ADMIN.

● Under Evaluate New Audit Trail Enhancement Mode (transaction S_AUT10), it is possible to display all changes that have been processed for the change document objects in SAP Management of Change, /IAM/ACT (activity) and /IAM/ISSUE (change request).

More Information

● For more information on change documents see the documentation at http://help.sap.com/netweaver. Choose the the relevant SAP NetWeaver version and open the following documentation:

○ Under Application Help, go to SAP NetWeaver Library: Function-Oriented View Application Server ABAP Other Services Services for Application Developers Change Documents .

○ Under Security, open the SAP NetWeaver Security Guide and go to Security Aspects for Lifecycle Management Auditing and Logging .

● For more information on logging changes of change requests and activities in SAP Management of Change, see the product assistance on the SAP Help Portal at http://help.sap.com/managementofchange. Under Application Help, open the SAP Library and go to Data Protection in SAP Management of Change Logging Changes .

● For more information on archiving change documents in SAP Management of Change, see the product assistance on the SAP Help Portal at http://help.sap.com/managementofchange. Under Application Help, open the SAP Library and go to Data Archiving in SAP Management of Change.

5.11 Enterprise Services Security

The following chapters in the NetWeaver Security Guide are relevant for all enterprise services delivered with SAP Management of Change:

http://service.sap.com/securityguide SAP NetWeaver 7.0 Security Guides (Complete)

● User Administration and Authentication

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 47

● Network and Communication Security● Security Guide for Usage Type PI● Web Services Security● Security Guide Communication Interfaces● Security Guides for Operating System and Database Platforms● Security Aspects for System Management● Enabling Application-to-Application Processes: Security Aspects● Enabling Business-to-Business Processes: Security Aspects

For more information about special security requirements for Web services, see the SAP NetWeaver Documentation on SAP Help Portal at http://help.sap.com SAP NetWeaver SAP NetWeaver 7.0 (2004s)SAP NetWeaver 7.0 Library SAP NetWeaver Library SAP NetWeaver Developer’s Guide Fundamentals Using Java Core Development Tasks Providing and Consuming Web Services Web Service Toolset Web Services Security .

5.12 Services for Security Lifecycle Management

Use

The following services are available from Active Global Support to assist you in maintaining security in your SAP systems on an ongoing basis.

Security Chapter in the EarlyWatch Alert (EWA) Report

This service regularly monitors the Security chapter in the EarlyWatch Alert report of your system. It tells you:

● Whether SAP Security Notes have been identified as missing on your system.In this case, analyze and implement the identified SAP Notes if possible. If you cannot implement the SAP Notes, the report should be able to help you decide on how to handle the individual cases.

● Whether an accumulation of critical basis authorizations has been identified.In this case, verify whether the accumulation of critical basis authorizations is okay for your system. If not, correct the situation. If you consider the situation okay, you should still check for any significant changes compared to former EWA reports.

● Whether standard users with default passwords have been identified on your system.In this case, change the corresponding passwords to non-default values.

Security Optimization Service (SOS)

The Security Optimization Service can be used for a more thorough security analysis of your system, including:

● Critical authorizations in detail● Security-relevant configuration parameters● Critical users● Missing security patches

This service is available as a self-service within SAP Solution Manager, as a remote service, or as an on-site service. We recommend you use it regularly (for example, once a year) and in particular after significant system changes or in preparation for a system audit.

48 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Security Information

Security Configuration Validation

The Security Configuration Validation can be used to continuously monitor a system landscape for compliance with predefined settings, for example, from your company-specific SAP Security Policy. This primarily covers configuration parameters, but it also covers critical security properties like the existence of a non-trivial Gateway configuration or making sure standard users do not have default passwords.

Security in the RunSAP Methodology / Secure Operations Standard

With the E2E Solution Operations Standard Security service, a best practice recommendation is available on how to operate SAP systems and landscapes in a secure manner. It guides you through the most important security operation areas and links to detailed security information from SAP’s knowledge base wherever appropriate.

More Information

For more information about these services, see:

● EarlyWatch Alert: http://service.sap.com/ewa● Security Optimization Service / Security Notes Report: http://service.sap.com/sos● Comprehensive list of Security Notes: http://service.sap.com/securitynotes● Configuration Validation: http://service.sap.com/changecontrol● RunSAP Roadmap, including the Security and the Secure Operations Standard: http://service.sap.com/runsap

(See the RunSAP chapters 2.6.3, 3.6.3 and 5.6.3)

5.13 Security-Relevant Logging and Tracing

The trace and log files of SAP Management of Change use the standard mechanisms of SAP NetWeaver.

For more information, see the following sections in the SAP NetWeaver Security Guide at http://service.sap.com/securityguide under Auditing and Logging.

SAP Management of Change (powered by SAP NetWeaver)Security Information C U S T O M E R 49

6 Solution-Wide Topics

6.1 Solution Manager

We highly recommend SAP Solution Manager as a platform to efficiently support the implementation of your solution. Using SAP Solution Manager significantly accelerates the implementation process and helps you achieve your business goals. We also deliver Support Services based on the business scenarios designed and documented in SAP Solution Manager. Implementation content for your solution can further accelerate the implementation process. For information about availability of content specifically tailored to your solution, see SAP Service Marketplace at http://service.sap.com/solutionmanager .

6.2 Service-Oriented Architecture (SOA)

SAP´s delivery on SOA (service-oriented architecture) differs from the pure architectural concept of SOA in the delivery of ready-to use enterprise services. Enterprise services are SAP-defined Web services which provide end-to-end business processes or individual business process steps that can be used to compose business scenarios while ensuring business integrity and ease of reuse. SAP designs and implements enterprise service interfaces to ensure semantic harmonization and business relevance. This section deals with the service-enablement of SAP Management of Change.

6.3 Service Enablement

The service enablement of SAP Management of Change consists of one or more of the following SAP components:

● SAP Management of ChangeEnterprise services are an integral part of the software components of the SAP Management of Change. Enterprise services are the technical interfaces to the functionality available in the business application.

● SAP NetWeaver PI 7.0 or higherSAP NetWeaver Process Integration (SAP NetWeaver PI) is an open integration and application platform that provides tools enabling you to set up a service-oriented architecture for business applications. You can use the platform for providing, discovering, and consuming services, integrating applications using the integration server, and managing business processes. Process integration is required in a runtime environment to consume enterprise services in a mediated scenario.We recommend that you use the highest version of SAP NetWeaver Process Integration (PI). For more information, see SAP Note 1515223 and SAP Note 1388258 .

NoteStarting with SAP NetWeaver Process Integration (PI) 7.3, SAP provides a new installation option Advanced Adapter Engine Extended (AEX). Since AEX is based on AS Java alone, it is easier to install and maintain as

50 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Solution-Wide Topics

well as it needs less memory and data storage. Therefore, AEX is a cost-saving option compared to a full installation of SAP NetWeaver PI. For more information about the AEX, see the SAP Library at: http://help.sap.com/nw73 SAP NetWeaver 7.3 Library English SAP NetWeaver Process IntegrationConcepts Installation and Connectivity Options Advanced Adapter Engine Extended and SAP Note 1573180 .

● Enterprise Services RepositoryThe Enterprise Services Repository (ES Repository) is the central repository that contains the definition of all enterprise services and models. The ES Repository is shipped with SAP NetWeaver PI and with SAP NetWeaver Composition Environment (CE) starting with SAP NetWeaver PI 7.1 and with SAP NetWeaver CE 7.1. The Enterprise Services Repository is a design time environment that enables you to create and enhance enterprise service definitions.

● Services RegistryThe Services Registry is shipped with SAP NetWeaver PI and SAP NetWeaver CE starting with SAP NetWeaver PI 7.1 and SAP NetWeaver CE 7.1. The Service Registry is required for the publication of enterprise service end-points (Web services) that have been configured and activated in the SAP Business Suite.

● SAP NetWeaver CE 7.1 or higherThe SAP NetWeaver Composition Environment (SAP NetWeaver CE) provides a robust environment for the design and implementation of composite applications.The design time environment of SAP NetWeaver CE can be used for the model-driven design and development of composite applications based on enterprise services. SAP NetWeaver CE offers the tools and the environment necessary for running composite applications fast and efficiently in a runtime environment.

6.4 Installation of the Service-Oriented Architecture (SOA)

Use

The installation of service interfaces, and therefore the service enablement of SAP Management of Change, consists of one or more of the following phases:

● Identification of software components and required business functionsYou use the technical data section of the enterprise service documentation to identify the following data for each enterprise service:○ the software component version with which the service was shipped○ the business function(s) required to be activated

● Identification of technical usages (relevant for SAP ERP only)SAP Note 1566412 provides a mapping of business functions and software component versions to technical usages. You use this documentation to identify the required technical usages for your list of software component versions and business functions.

● Installation of the software component ECC-SE (relevant for SAP ERP only)The software component ECC-SE contains service implementations for ECC (the ERP Central Component). This component must be explicitly installed if you intend to use enterprise services for ECC functionality. In this case you must also select the technical usage “ESA ECC-SE” during the enhancement package installation.

● Selection and installation together with the other parts of the enhancement package

SAP Management of Change (powered by SAP NetWeaver)Solution-Wide Topics C U S T O M E R 51

In the enhancement package installation process you must select all the technical usages you have identified for service enablement together with the technical usages you identified for enhanced features in SAP Business Suite. The selected technical usages will install the corresponding software components that contain the enterprise services interfaces and implementations.

● Import of ESR Content (XI Content) (optional)To install the content required for the enterprise service definitions you must select the technical usage “XI Content” in the enhancement package installation process. This usage type downloads the content files for SAP NetWeaver PI 7.0 or higher. Unpack the ZIP file and copy the tpz files corresponding to your SAP NetWeaver PI version into the import directory of your Integration Repository (for SAP NetWeaver PI 7.0x) or Enterprise Services Repository (for SAP NetWeaver ES Repository 7.1 or higher). Use the import function to import the content files into the corresponding repository (Integration Repository or Enterprise Services Repository). (Choose Tools Import Design Objects )

● Services Registry (optional)The services registry is shipped starting with SAP NetWeaver PI 7.1 and CE 7.1. You must configure the services registry and then publish the enterprise services from the Business Suite application to the registry using the transaction SOAMANAGER in the backend.For further information regarding the installation of SAP NetWeaver PI, CE and ES Repository, refer to the corresponding SAP NetWeaver Installation and Master Guides.

More Information

You can find enterprise service documentation specific to SAP Management of Change on SAP Help Portal under http://help.sap.com/managementofchange .

6.5 Related Documentation

For more information about the service-oriented architecture (SOA), see the SCN Community at http://scn.sap.com/community/soa (registration required).

6.6 List of References

The following table lists references to technologies used for SAP Management of Change

52 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Solution-Wide Topics

Table 24:

Title Where to Find

Web Dynpro ABAP SAP Library for SAP NetWeaver on SAP Help Portal at http://

help.sap.com/netweaver for SAP NetWeaver 7.0

including Enhancement Package 2 SAP NetWeaver 7.0

Library (including Enhancement Package 2) English SAP

NetWeaver SAP NetWeaver by Key Capability Application

Platform by Key Capability ABAP Technology UI

Technology Web UI Technology Web Dynpro ABAP

Floorplan Manager SAP Library for SAP NetWeaver on SAP Help Portal at http://

help.sap.com/netweaver for SAP NetWeaver 7.0

including Enhancement Package 2 SAP NetWeaver 7.0

Library (including Enhancement Package 2) English SAP

NetWeaver SAP NetWeaver by Key Capability Application

Platform by Key Capability ABAP Technology UI

Technology Web UI Technology Floorplan Manager for

Web Dynpro ABAP

Business Object Processing Framework (BOPF) For more information, see SAP Note 1457235 .

Personal Object Worklist SAP Library for SAP NetWeaver on SAP Help Portal at http://

help.sap.com/nw SAP NetWeaver by Key Capability

Application Platform by Key Capability ABAP Technology

UI Technologies in ABAP Personal Worklist (Personal

Worklist) Personal Object Worklist (POWL) Component.

SAP Business Rules Framework Plus For more information, see the Business Rule Framework plus (BRFplus) documentation at http://help.sap.com

BC Sets SAP Library for SAP NetWeaver on SAP Help Portal at http://

help.sap.com/nw for SAP NetWeaver 7.0 Including

Enhancement Package 3 Application Help Function-

Oriented View Solution Life Cycle Management by Key

Capability Customizing (link in text) Business

Configuration Sets (BC-CUS)

SAP Solution Manager SAP Library on SAP Help Portal at http://help.sap.com

SAP Solution Manager SAP Solution Manager 7.0 SP34

English Service Desk

SAP Management of Change (powered by SAP NetWeaver)Solution-Wide Topics C U S T O M E R 53

A Appendix

A.1 List of Notes

For an overview of all notes relevant for SAP Management of Change, see the Release Information Note 1704387.

A.2 List of Documents

The following table lists all documents mentioned in this Administrator's Guide.

Table 25:

Title

Installation Guides

Location on SAP Service Marketplace

Installation Guides SAP ERP 6.0 http://service.sap.com/erp-inst SAP ERP 6.0 Installation

Installation Guides for SAP enhancement packages for SAP ERP 6.0

http://service.sap.com/erp-inst SAP ERP 6.0 SAP

enhancement packages for SAP ERP 6.0 Installation

Installation Guide – SAP NetWeaver http://service.sap.com/instguidenw <release<release>

Installation

Installation Guide – SAP Solution Manager http://service.sap.com/instguides SAP Components SAP

Solution Manager

Table 26:

Title

Master Guides

Location on SAP Service Marketplace

SAP ERP 6.0 http://service.sap.com/erp-inst SAP ERP 6.0 Planning

SAP NetWeaver 7.0 http://service.sap.com/einstallnw70 Planning

54 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Appendix

Table 27:

Title

Upgrade Master Guides

Location on SAP Service Marketplace

Software Update Manager 1.0 Update Guide - Update of SAP Systems Using Software Update Manager 1.0. You can download the latest version of this guide from SAP Service Marketplace at http://serv­ice.sap.com/sltoolset

A.3 Media List

Table 28:

Installable Software Unit Title of Downloadable Objects from http://serv­ice.sap.com/swdc

SAP Management of Change SAP Management of Change 1.0

EHP6 FOR SAP ERP 6.0 Re-Use components for BS7i2011 In­stallation

SAP NW 7.0 EhP3 Re-Use Components (Installation)

SAP Management of Change 1.0 SP00

HTML-Help for Windows

Standard HTML (Plain HTML)

SAP Management of Change 1.0 Online Documentation

For installation documentation and Media List for SAP NetWeaver, see SAP Service Marketplace at http://service.sap.com/instguidesnw .

SAP Management of Change (powered by SAP NetWeaver)Appendix C U S T O M E R 55

Important Disclaimers and Legal Information

Coding SamplesAny software coding and/or code lines / strings ("Code") included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, unless damages were caused by SAP intentionally or by SAP's gross negligence.

Gender-Neutral LanguageAs far as possible, SAP documentation is gender neutral. Depending on the context, the reader is addressed directly with "you", or a gender-neutral noun (such as "sales person" or "working days") is used. If when referring to members of both sexes, however, the third-person singular cannot be avoided or a gender-neutral noun does not exist, SAP reserves the right to use the masculine form of the noun and pronoun. This is to ensure that the documentation remains comprehensible.

Internet HyperlinksThe SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint about where to find related information. SAP does not warrant the availability and correctness of this related information or the ability of this information to serve a particular purpose. SAP shall not be liable for any damages caused by the use of related information unless damages have been caused by SAP's gross negligence or willful misconduct. All links are categorized for transparency (see: https://help.sap.com/viewer/disclaimer).

56 C U S T O M E RSAP Management of Change (powered by SAP NetWeaver)

Important Disclaimers and Legal Information

SAP Management of Change (powered by SAP NetWeaver)Important Disclaimers and Legal Information C U S T O M E R 57

go.sap.com/registration/contact.html

© 2018 SAP SE or an SAP affiliate company. All rights reserved.No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice.Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary.These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.Please see https://www.sap.com/corporate/en/legal/copyright.html for additional trademark information and notices.