Administrator’s Guide

SAP Commercial Project Management 2.0 SP04

PICM 200

Project Issue and Change Management

Target Audience

Consultants

Administrators

Others

PUBLIC

Document Version 003 – December 2016

2 December 2016

© Copyright 2016 SAP AG. All rights reserved.

SAP Library document classification: PUBLIC

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

Microsoft, Windows, Excel, Outlook, PowerPoint, Silverlight, and Visual Studio are registered trademarks of Microsoft Corporation.

IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, z10, z/VM, z/OS, OS/390, zEnterprise, PowerVM, Power Architecture, Power Systems, POWER7, POWER6+, POWER6, POWER, PowerHA, pureScale, PowerPC, BladeCenter, System Storage, Storwize, XIV, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, AIX, Intelligent Miner, WebSphere, Tivoli, Informix, and Smarter Planet are trademarks or registered trademarks of IBM Corporation.

Linux is the registered trademark of Linus Torvalds in the United States and other countries.

Adobe, the Adobe logo, Acrobat, PostScript, and Reader are trademarks or registered trademarks of Adobe Systems Incorporated in the United States and other countries.

Oracle and Java are registered trademarks of Oracle and its affiliates.

UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems Inc.

HTML, XML, XHTML, and W3C are trademarks or registered trademarks of W3C®, World Wide Web Consortium, Massachusetts Institute of Technology.

Apple, App Store, iBooks, iPad, iPhone, iPhoto, iPod, iTunes, Multi-Touch, Objective-C, Retina, Safari, Siri, and Xcode are trademarks or registered trademarks of Apple Inc.

IOS is a registered trademark of Cisco Systems Inc.

RIM, BlackBerry, BBM, BlackBerry Curve, BlackBerry Bold, BlackBerry Pearl, BlackBerry Torch, BlackBerry Storm, BlackBerry Storm2, BlackBerry PlayBook, and BlackBerry App World are trademarks or registered trademarks of Research in Motion Limited.

Google App Engine, Google Apps, Google Checkout, Google Data API, Google Maps, Google Mobile Ads, Google Mobile Updater, Google Mobile, Google Store, Google Sync, Google Updater, Google Voice, Google Mail, Gmail, YouTube, Dalvik and Android are trademarks or registered trademarks of Google Inc.

INTERMEC is a registered trademark of Intermec Technologies Corporation.

Wi-Fi is a registered trademark of Wi-Fi Alliance.

Bluetooth is a registered trademark of Bluetooth SIG Inc.

Motorola is a registered trademark of Motorola Trademark Holdings LLC.

Computop is a registered trademark of Computop Wirtschaftsinformatik GmbH.

SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP BusinessObjects Explorer, StreamWork, SAP HANA, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.

Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an SAP company.

Sybase and Adaptive Server, iAnywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase Inc. Sybase is an SAP company.

Crossgate, m@gic EDDY, B2B 360°, and B2B 360° Services are registered trademarks of Crossgate AG in Germany and other countries. Crossgate is an SAP company.

All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary.

These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

4 December 2016

Administrator’s Guide for Project Issue and Change Management

December 2016 5

Table of Contents

1 Document History .................................................................. 7

2 Getting Started ....................................................................... 7

2.1 About this Guide ..................................................................... 7

2.2 Related Documentation .......................................................... 9

2.2.1 Planning Information.................................................................. 9

2.2.2 Further Useful Links................................................................. 10

2.2.3 Related Guides ......................................................................... 10

2.3 Important SAP Notes ............................................................10

3 Overview of Project Issue and Change Management ....... 12

3.1 Software Units of Project Issue and Change Management13

3.2 Software Component Matrix ................................................13

3.3 System Landscape ................................................................15

4 Installation Information ....................................................... 16

4.1 Overall Implementation Sequence ......................................16

4.2 Set-Up of Project Cost and Revenue Planning ..................17

4.3 Set-Up of Analytics ...............................................................18

4.4 Definition of RFC Destinations for Charts ..........................18

4.5 Cascading of Switch BC Sets ..............................................18

4.6 Configuration of Display Options for Analytical Reports .18

4.7 Steps to Import the Customizing Application of BRFplus 19

5 Operation Information ......................................................... 20

5.1 Monitoring of Project Issue and Change Management .....20

5.1.1 Alert Monitoring ........................................................................ 20

5.1.2 Monitoring Installation and Setup ........................................... 20

5.1.3 Detailed Monitoring and Tools for Problem and Performance Analysis ................................................................................................. 20

5.2 Management of Project Issue and Change Management ..22

5.2.1 Starting and Stopping .............................................................. 22

5.2.2 Software Configuration ............................................................ 23

5.2.3 Administration Tools................................................................ 23

5.2.4 Backup and Restore ................................................................. 23

5.3 Software Change Management ............................................24

5.3.1 Transport and Change Management ...................................... 25

5.3.2 Development Requests and Development Release Management .......................................................................................... 25

5.3.3 Support Packages and Patch Implementation ....................... 25

Administrator’s Guide for Project Issue and Change Management

6 December 2016

5.4 Troubleshooting ....................................................................25

5.4.1 Support Desk Management ..................................................... 25

5.4.2 Remote Support Setup ............................................................. 26

6 Security Information ............................................................ 26

6.1 Before You Start ....................................................................26

6.2 Technical System Landscape ..............................................27

6.3 Additional Information ..........................................................27

6.4 User Administration and Authentication ............................27

6.4.1 User Management .................................................................... 28

6.4.2 User Data Synchronization ...................................................... 29

6.4.3 Integration into Single Sign-On Environments ...................... 29

6.5 Authorizations .......................................................................30

6.6 Session Security Protection ................................................32

6.7 Network and Communication Security ...............................33

6.7.1 Communication Channel Security .......................................... 34

6.7.2 Network Security ...................................................................... 34

6.7.3 Communications Destinations ................................................ 36

6.8 Data Storage Security ...........................................................36

6.9 Data Archiving .......................................................................37

6.9.1 Archiving Issues and Change Requests with /PICM/BO_I .... 37

6.9.2 Archiving Activities with /PICM/BO_A .................................... 38

6.10 Data Protection ....................................................................40

6.10.1 Deletion of Personal Data ........................................................ 42

6.11 Security-Relevant Logging and Tracing ...........................44

7 Solution-Wide Topics .......................................................... 44

7.1 List of References .................................................................44

7.2 Application Program Interfaces (APIs) ...............................44

2.1 About this Guide

December 2016 7

1 Document History Caution

Before you start the implementation, make sure you have the latest version of this document. You can find the latest version at the following location: http://service.sap.com/instguides.

We strongly recommend that you use the documents there. The guides are updated regularly.

Version Date of Change Description of Change

002 2016-May-17 In chapter 6.5, the following statement has been changed.

From:

For more information about the authorization objects required for deployment of Project Issue and Change Management as an add-on on SAP ERP, see the administrator’s guide for CPD 1.0.

To:

For more information about the authorization objects required for the deployment of Project Issue and Change Management as an add-on on SAP ERP, see the Authorizations chapter in the administrator’s guide of CPD 2.0.

003 2016-Dec-28 Typo: There were still some occurrences of EhP6; these are corrected to EhP7.

2 Getting Started

2.1 About this Guide

This Administrator’s Guide is the central starting point for the technical implementation

of Project Issue and Change Management (CA-CPD-PCM). You can find cross-

scenario implementation information as well as scenario-specific information in this guide.

Use this Guide to get an overview of Project Issue and Change Management, its software units, and its scenarios from a technical perspective. The Administrator’s

Getting Started

8 December 2016

Guide is a planning tool that helps you to design your system landscape. It refers you to the required detailed documentation.

The Administrator’s Guide is a single source of information to support the implementation and operation of Project Issue and Change Management. Therefore, it includes the following information:

Planning Information

This chapter of the Administrator’s Guide provides you with the most important information regarding the implementation of Project Issue and Change Management, including an overview of the related planning information, its software units, the system landscape, and the overall implementation sequence.

Installation Overview

This chapter gives you an overview of the installation components and the sequence in which they are installed, as described in detail in the Release Strategy Note 2129693.

Operation Information

This chapter provides you with the information that you require to operate Project Issue and Change Management.

Security Information

This chapter provides you with the information that you require to operate Project Issue and Change Management securely.

Constraints

The scenarios that are presented here serve as examples of how you can use SAP software in your company. The scenarios are only intended as models and do not necessarily run the way they are described here in your customer-specific system landscape. Ensure to check your requirements and systems to determine whether these scenarios can be used productively at your site. Furthermore, we recommend that you test these scenarios thoroughly in your test systems to ensure they are complete and free of errors before going live.

This Administrator’s Guide primarily discusses the overall technical implementation of Project Issue and Change Management, rather than its

2.2 Related Documentation

December 2016 9

subordinate components. This means that additional software dependencies might exist without being mentioned explicitly in this document. You can find more information about component-specific software dependencies in the corresponding guides.

NOTE

You can find the most current information about the technical implementation of Project Issue and Change Management and the latest guides on SAP Service Marketplace at service.sap.com/instguides. We strongly recommend that you use the documents available here. The guides are regularly updated.

2.2 Related Documentation

2.2.1 Planning Information

For more information about planning topics not covered in this guide, see the following content on SAP Service Marketplace:

Topic Guide/Tool

Latest versions of installation and upgrade information

http://service.sap.com/instguides SAP Business Suite Applications SAP ERP Add-Ons SAP Commercial Project Management SAP Commercial Project Management 2.0

SAP Business Maps – information about applications and business scenarios

http://service.sap.com/businessmaps

Sizing, calculation of hardware requirements – such as CPU, disk and memory resource – with the Quick Sizer tool

http://service.sap.com/quicksizer

http://service.sap.com Products Database

& technology Performance and Sacalability Sizing Sizing Guidelines SAP ERP SAP Commercial Project Management

Released platforms and technology-related topics such as maintenance strategies and language support

http://service.sap.com/platforms

To access the Platform Availablity Matrix directly,

enter http://service.sap.com/pam

Network security http://service.sap.com/securityguide

High Availability http://www.sdn.sap.com/irj/sdn/ha

Performance http://service.sap.com/performance

Information about Support Package

http://service.sap.com/sp-stacks

Getting Started

10 December 2016

Stacks, latest software versions and patch level requirements

Information about Unicode technology

http://www.sdn.sap.com/irj/sdn/i18n

2.2.2 Further Useful Links

The following table lists further useful links on SAP Service Marketplace:

Content Location on SAP Service Marketplace

Information about creating error messages

http://service.sap.com/message

SAP Notes search http://service.sap.com/notes

SAP Software Distribution Center (software download and ordering of software)

http://service.sap.com/swdc

SAP Online Knowledge Products (OKPs) – role-specific Learning Maps

http://service.sap.com/rkt

2.2.3 Related Guides

You can find more information about the relevant applications in the following documents: Title Location

SAP NetWeaver 7.4

http://help.sap.com/nw74

Planning (SAP ERP 6.0) http://service.sap.com/erp-inst SAP ERP 6.0 Planning

SAP Enhancement Packages for SAP ERP 6.0

http://help.sap.com/erp SAP Enhancement Package 7 for SAP ERP 6.0

Project Workspace (CA-CPD-WS) and Project Cost and Revenue Planning (CA-CPD-FP)

http://help.sap.com/ca-cpd Administrator’s Guides

2.3 Important SAP Notes

You must read the following SAP Notes before you start the installation. These SAP Notes contain the most recent information on the installation, as well as corrections to the installation documentation. Make sure that you have the up-to-date version of each SAP Note, which you

can find on SAP Service Marketplace at http://service.sap.com/notes. For more

2.3 Important SAP Notes

December 2016 11

information about the validity of an SAP note for a specific SP or release, see the Validity section of the SAP note.

SAP Note Number

Description

2129693 Release Strategy for SAP Commercial Project Management 2.0

1653529 Overview: Notes on addon IAM

1640939 Release strategy for IAM

1653502 Installation of Add-On IAM 100

1760860 IAM Package Interface Enhancements 1

2126075 Release Information Note (RIN) (this note includes information about the equivalence levels of support pack stacks) for 2.0

1806291 Settings for Project Cost and Revenue Planning

1816800 Settings for Analytics

1800539 FAQ Note

1801813 Known Issues in SAP Commercial Project Management

1835982 Standard Texts Are Not Available

1824317 BRFplus - Potential Problem During SP Implementation

2011038 SICF Services Not Activated by Default

2005127 Missing BC Set Entries Required for PDF Forms

2011017 Number Range Not Same

2011031 Text Schema for Activities

2078507 Data Privacy Configuration for Issue and Change Management

2078866 Custom and Standard Themes Not Set Through Global Parameters

2091312 System Dependency Not Defined for Object Type RSK

1873892 BOBF BUPA Subnode Keys Not Found, Therefore BP Data Is Not displayed

2057739 Data Access to Issues Ignores All Issue Categories that Are Not QIM or MoC

2114079 Tree UIBB: FPM Event When User Selects Rows

2049928 Error on Saving BRF+ Application

2122136 Browser Compatibility Issue

Overview of Project Issue and Change Management

12 December 2016

2159011 The System Does Not Update the Activity ID When Issues or Change Requests Are Saved

2168532

Cannot Assign Existing Issue to Related Reference Objects

NOTE This SAP note is only relevant if the software component IAM is at release 1.0 SP07 or higher.

2143119

NOTE This SAP note is only relevant if the software component IAM is at release 1.0 SP07 or higher.

2072596 Error Message After Adding Attachment of Type File

3 Overview of Project Issue and Change Management With Project Issue and Change Management, a flexible tool is provided in order to cover issue and change request handling for all industries. It enables easy tracking and analyses of issues, change requests, and related activities – also across systems and applications.

Project Issue and Change Management (CA-CPD-PCM) (PICM 200) is based on

SAP NetWeaver 7.4.

Deployment

Project Issue and Change Management (CA-CPD-PCM) (PICM 200) can be

deployed as:

o An add-on solution to an existing SAP ERP system (as of SAP enhancement package 7 for SAP ERP):

The prerequisite is SAP NetWeaver 7.4

o A standalone solution:

The prerequisite is SAP NetWeaver 7.4

Installation

3.1 Software Units of Project Issue and Change Management

December 2016 13

Project Issue and Change Management (CA-CPD-PCM) (PICM 200) can be

installed on the following NetWeaver versions:

o SAP NetWeaver 7.4

For information about the applicable SPs, see SAP note 2129693.

3.1 Software Units of Project Issue and Change Management

The software units required for Project Issue and Change Management are as follows:

Type of Component Component

Software component SAP NW 7.4 : SAP NetWeaver

Software component SAP BS_FND 747: SAP Business Suite Foundation

Software component SAP ERP 6.0 Enhancement Package 7 (if Project Issue and Change Management is deployed on SAP ERP)

Software component IAM 100 Issue and Activity Management

For information about the applicable SPs, see SAP note 2129693.

3.2 Software Component Matrix

This section provides an overview of which scenario of Project Issue and Change Management uses which software unit. For the latest component version and patch level requirements, see http://service.sap.com/sp-stacks.

Type of Component Component

Software component SAP NW 7.4: SAP NetWeaver

Software component SAP BS_FND 747: SAP Business Suite Foundation

There are two deployment scenarios for Project Issue and Change Management, and your installation depends on which scenario you choose. You can use Project Issue and Change Management in the following scenarios:

Standalone: Project Issue and Change Management as a standalone solution

Add-on: Project Issue and Change Management as an add-on solution on SAP ERP. In this variant, Project Issue and Change Management and SAP ERP run on the same system. You can use the master and organizational database of SAP ERP.

Key:

x = mandatory

(x) = optional

- = not relevant

Overview of Project Issue and Change Management

14 December 2016

Scenario Project Issue and Change Management

Adobe Document Server (ADS)

SAP BS FND 747

SAP Netweaver 7.4

SAP ERP 6 including EhP7

SAP Solution Manager Content

Project Issue and Change Management as a standalone

x x x x (x) x

Project Issue and Change Management as an add-on on SAP ERP 6.0 EhP7

x x x x x x

3.3 System Landscape

December 2016 15

3.3 System Landscape

The following section describes how the system landscape can be set up. It also describes the implementation sequence.

Components PICM (CA-CPD-PCM) This component is placed above the IAM engine and it runs the UI configurations and worklists.

Installation Information

16 December 2016

IAM (CA-IAM-ENG) The IAM engine runs Project Issue and Change Management. It covers the generic engine for the application. Communication Between Back and Front Ends The communication between back end and front end is HTTP. The applications are accessed from the front end by using SAP NetWeaver Business Client (NWBC). The applications can also be called using SAP NWBC for HTML, a lighter version of NWBC with zero footprint. Communication with Other SAP Systems You can communicate with other Suite systems using remote function calls (RFCs). SAP Solution Manager is useful for installing IAM and connecting to different systems. Prerequisites Project Issue and Change Management system needs SAP NetWeaver 7.4, SAP_BS_FND 747, and WEBCUIF 747. For the SAP ERP add-on scenario, you also require SAP ERP EhP 7.

4 Installation Information

4.1 Overall Implementation Sequence

This section describes the implementation sequence for Project Issue and Change Management.

NOTE For the latest component version and patch level requirements, as well as more detailed information about the installation process for Project Issue and Change Management, see the following notes: PICM (CA-CPD-PCM) Release strategy note: 2129693 Release information note (RIN): 2126075 IAM (CA-IAM-ENG) Release strategy for IAM: 1640939 Installation of Add-on IAM 100: 1653502 Overview Note: 1653529

PICM Standalone 1. Install (or update) SAP NW 7.4

2. Install (or update) the IAM (CA-IAM-ENG) layer

4.2 Set-Up of Project Cost and Revenue Planning

December 2016 17

3. Install (or update) PICM (CA-CPD-PCM)

4. Install (or update) local BI Content for Project Issue and Change Management

5. Activate the /PICM/CA_CPD_PICM_1 business function (see transaction SFW5

Enterprise Business Functions /PICM/CA_CPD_PICM_1)

6. Install SAP NetWeaver Business Client (NWBC) for Desktop (optional)

PICM on ERP 1. Install (or update) SAP NW 7.4

2. Install (or update) SAP ERP

3. Install (or update) the IAM (CA-IAM-ENG) layer

4. Install (or update) PICM (CA-CPD-PCM)

5. Install (or update) local BI Content for Project Issue and Change Management (for more information, see SAP note 1816800)

6. Activate the /PICM/CA_CPD_PICM_1 business function (see transaction SFW5

Enterprise Business Functions /PICM/CA_CPD_PICM_1)

7. Install (or update) CPD (CA-CPD-WS) and CPD (CA-CPD-FP) (optional)

a. Activate the /CPD/CA_CPD_PWS_1 business function (see transaction

SFW5 Enterprise Business Functions /CPD/CA_CPD_PWS_1)

b. Activate the /CPD/CA_CPD_PFP_1 business function (see transaction

SFW5 Enterprise Business Functions /CPD/CA_CPD_PFP_1) c. Implement the SAP note 1797904 d. Install AO 1.4

8. Install NWBC for Desktop (optional)

If you want to use NWBC for Desktop (instead of or in addition to) NWBC for HMTL, a client set-up is necessary. You should download the latest version of NWBC for desktop, and then uninstall the old version before installing the new version. For more information about NWBC for Desktop, see the SAP NetWeaver Business Client documentation at:

SAP NetWeaver Business Client

http://help.sap.com/nw74 Application Help Function-Oriented View UI Technologies in SAP NetWeaver UI Technologies in ABAP SAP NetWeaver Business Client

4.2 Set-Up of Project Cost and Revenue Planning

SAP Commercial Project Management uses the BW layer that is available in each NetWeaver stack. Project Cost and Revenue Planning uses BW Integrated Planning (BW-

Installation Information

18 December 2016

IP), which uses real-time InfoCubes to capture data generated through input-ready queries and planning functions. Therefore, only a configuration of the local BI client is required (and not an additional BI system).

For setting up Project Cost and Revenue Planning, see SAP note 1806291.

4.3 Set-Up of Analytics

You must activate the Analytics content under the info-areas /CPD/AVR (if Project

Issue and Change Management and SAP ERP run on the same system) and

/PICM/AVR. For more information about setting up Analytics, see the SAP Note

1816800.

4.4 Definition of RFC Destinations for Charts

If you use any ABAP-based front end technology (for example BSP, Web Dynpro ABAP, BEx Web Reporting, SAPGUI for HTML etc), you have to create an RFC destination in the SAP system to connect the IGS to the SAP system.

Implement the solution provided in SAP Note 454042.

4.5 Cascading of Switch BC Sets

You can cascade the Delivery Customizing of SAP Commercial Project Management to all clients by cascading the switch BC sets.

1. Go to the SE16 transaction.

2. Enter SFWPARAM as the table name.

3. Go to Table Create Entries.

4. Enter the parameter SBCSETS_ACTIVATE_IN_CLIENTS in the Name field.

5. Enter X in the Value field and confirm the entries.

6. Go to the SFW5 transaction to deactivate and then reactivate the following business functions:

/CPD/CA_CPD_PWS_1 (if relevant)

/CPD/CA_CPD_PFP_1 (if relevant)

/PICM/CA_CPD_PICM_1

4.6 Configuration of Display Options for Analytical Reports

Analytical UIBBs are used in Project Workspace to display reports such as Progress Analysis, Work in Progress, and Project Cost Status. By default, these reports are displayed in a SAP List Viewer (ALV) table. However, you can also choose to view these reports as a graphic, or a table and graphic, or using Crystal Reports. To enable additional options for displaying reports, it is necessary to make the following Customizing settings:

To configure options for Graphic and Table and Graphic displays, follow these steps:

4.7 Steps to Import the Customizing Application of BRFplus

December 2016 19

1. In Customizing for SAP NetWeaver, choose Application Server SAP List Viewer (ALV) Maintain Web Dynpro ABAP-Specific Settings.

2. Mark the Java Server Available checkbox.

Note that the display options are available in the frontend only if you also have enabled a Java server.

To configure options for Crystal Reports, follow these steps:

1. In Customizing for SAP NetWeaver, choose Application Server SAP List Viewer (ALV) Maintain SAP GUI-Specific Settings.

2. Mark the Allow Crystal Reports checkbox.

Note

SAP Commercial Project Management does not deliver any Crystal Report template for viewing reports.

Crystal reporting requires a special viewer in the frontend. This setting is only meaningful if this viewer has been installed. For more information, see SAP note 1353044.

4.7 Steps to Import the Customizing Application of BRFplus

In client 000:

1. Run the report FDT_TRANS.

2. Provide the relevant workbench/customizing request.

3. Enter the object ID as F0D5105146757029E10000000A42852B.

4. Select the Transport Whole Application(s) radio button.

In the productive client:

1. Launch the transaction SCC1.

2. Enter the source client as 000.

3. Provide the transport request in which you have transported the application (from client 000).

4. Mark the checkbox Include Request Subtasks.

5. Execute the transaction.

For NW release 7.40, we recommend that you use BRF+ with at least SP05. If you face a dump when the request is released ,this can be fixed with SAP note 2001020.

Operation Information

20 December 2016

5 Operation Information

5.1 Monitoring of Project Issue and Change Management

Within the management of SAP technology, monitoring is an essential task. A section has therefore been devoted solely to this subject. You can find more information about the underlying technology in: SAP NetWeaver 7.4

http://help.sap.com/nw74 System Administration and Maintenance Information Technical Operations for SAP NetWeaver

5.1.1 Alert Monitoring

Proactive, automated monitoring is the basis for ensuring reliable operations for your SAP system environment. SAP provides you with the infrastructure and recommendations needed to set up your alert monitoring to recognize critical situations for Project Issue and Change Management as quickly as possible. Project Issue and Change Management does not offer specific data in the Computer Center Management System (CCMS) for alert monitoring. Nevertheless general monitoring options can be used. For information and detailed procedures related to the alert monitoring in SAP NetWeaver 7.4, see the Monitoring Setup Guide for SAP NetWeaver at: SAP NetWeaver 7.4 http://help.sap.com/nw74 System

Administration and Maintenance Information Technical Operations for SAP NetWeaver Administration of SAP NetWeaver systems and components Administration of Application Server ABAP Monitoring and Administration Tools for Application Server ABAP

5.1.2 Monitoring Installation and Setup

In order to enable the auto-alert mechanism of CCMS, see SAP Note 617547.

5.1.3 Detailed Monitoring and Tools for Problem and Performance Analysis

PICM 200 is based on WebAS 740, which is a part of SAP NetWeaver. Project Issue and Change Management supports the use of SAP Business Rules Framework plus (BRFplus) to:

Determine business partners for issues and activities

5.1 Monitoring of Project Issue and Change Management

December 2016 21

Determine additional activities for issues

Find experts for certain activities

It is not recommended to activate these BRFplus traces for long periods of time as they are performance critical.

Procedure

Trace data can be found in the BRFplus Workbench as follows:

1. Start transaction BRFplus to open the BRFplus Workbench.

2. Switch to expert mode by choosing the Personalize User mode.

3. In the Tools menu choose Lean Trace.

4. Enter the required BRFplus function using the given selection data.

5. Start the search to see if any trace data is available.

Operation Information

22 December 2016

5.1.3.1 Trace and Log Files

Trace files and log files are essential for analyzing problems. The standard SAP NetWeaver tools such as transactions ST22 (Run Time Errors) and SM21 (System Log) can be used to monitor trace and log files. For more information, see: Depending on the version of SAP NetWeaver installed:

SAP NetWeaver 7.0

http://help.sap.com/nw74 System Administration and Maintenance Information Technical Operations for SAP NetWeaver Administration of SAP NetWeaver systems and components Administration of Application Server ABAP Monitoring and Administration Tools for Application Server ABAP

5.2 Management of Project Issue and Change Management

SAP provides you with an infrastructure to help your technical support consultants and system administrators effectively manage all SAP components and complete all tasks related to technical administration and operation. Additional information can be found in SAP Solution Manager documentation on SAP Help Portal at http://help.sap.com SAP Solution Manager. You can find more information about the underlying technology in the Technical Operations Manual in SAP Library under SAP NetWeaver.

5.2.1 Starting and Stopping

The Stop Sequence is in reverse order to the Start Sequence. Start and Stop Sequences and Tools

Software Component

Sequence Tool Comments

SAP NW 7.4 1 STARTSAP / STOPSAP (Unix) SAPMMC (Windows)

-

SAP BS_FND

2 STARTSAP / STOPSAP (Unix) SAPMMC (Windows)

-

5.2 Management of Project Issue and Change Management

December 2016 23

SAP ERP 6.0 EHP7

3 STARTSAP / STOPSAP (Unix) SAPMMC (Windows)

Only if PICM is running as an add-on

PICM ABAP Server 4 STARTSAP / STOPSAP (Unix) SAPMMC (Windows)

-

For more information about STARTSAP/ STOPSAP and SAPMMC, see the Technical Operations Manual for SAP NetWeaver in: Depending on the version of SAP NetWeaver installed:

SAP NetWeaver 7.4

http://help.sap.com/nw74 System Administration and Maintenance Information Technical Operations for SAP NetWeaver

5.2.2 Software Configuration

This chapter explains which components or scenarios used by this application are configurable and which tools are available for adjusting. The Implementation Guide (IMG) is the standard SAP tool for component Customizing. Customizing settings for Project Issue and Change Management can be found under Cross-Application Components SAP Commercial Project Management Project Issue and Change Management. The configuration guide can be found at http://help.sap.com/ca-cpd Configuration and Deployment Information Configuration Information.

5.2.3 Administration Tools

Most of the tools are based on the latest SP of SAP NetWeaver 7.4.

5.2.4 Backup and Restore

You need to back up your system landscape regularly to ensure that you can restore and recover it in case of failure. The backup and restore strategy for Project Issue and Change Management consists of two parts:

Backup and restore coverage for each component

Cross-system data dependencies and handling

Operation Information

24 December 2016

The backup and restore strategy for your system landscape should not only consider SAP systems but should also be embedded in overall business requirements and incorporate your company’s entire process flow. In addition, the backup and restore strategy must cover disaster recovery processes, such as the loss of a data center through fire. It is most important in this context that you ensure that backup devices are not lost together with normal data storage (separation of storage locations). Based on the type of application data contained in a component, a categorization scheme for system components can be used to analyze the backup requirements of any system component and to easily determine an appropriate backup method for this component. For more information, see the best practices document at http://service.sap.com/bp-roadmap Backup and Restore for SAP System Landscapes.

5.3 Software Change Management

Software Change Management standardizes and automates software distribution, maintenance, and testing procedures for complex software landscapes and multiple software development platforms. These functions support your project teams, development teams, and application support teams.

The goal of Software Change Management is to establish consistent, solution-wide change management that allows for specific maintenance procedures, global rollouts (including localizations), and open integration with third-party products. This section provides additional information about the most important software components. The following topics are covered:

Transport and Change Management: Enables and secures the distribution of software changes from the development environment to the quality assurance and production environment.

Development Request and Development Release Management: Enables customer-specific maintenance procedures and open integration with third-party products.

Template Management: Enables and secures the rollout of global templates, including localizations.

Quality Management and Test Management: Reduces the time, cost, and risk associated with software changes.

Support Packages and SAP Notes Implementation: Provides standardized software distribution and maintenance procedures. Release and Upgrade Management: Reduces the time, cost, and risk associated with upgrades.

5.4 Troubleshooting

December 2016 25

5.3.1 Transport and Change Management

All components of Project Issue and Change Management are client-enabled. For transport and change management issues, the procedures of SAP NetWeaver apply. For more information, see SAP NetWeaver documentation.

5.3.2 Development Requests and Development Release Management

The standard procedures of SAP NetWeaver apply. See the Technical Operations Manual for SAP NetWeaver on SAP Help Portal under SAP NetWeaver.

5.3.3 Support Packages and Patch Implementation

We recommend that you implement Support Package Stacks (SP Stacks), which are sets of support packages and patches for the respective product version that must be used in the given combination. The technology for applying support packages and patches will not change. Read the corresponding Release and Information Notes before you apply any support packages or patches of the selected SP Stack. Use the Maintenance Optimizer (transaction DSWP) of the SAP Solution Manager to select, download, and install the

needed usages, or software components and required support packages. For more information, see the following:

SAP Solution Manager documentation on SAP Help Portal at http://help.sap.com SAP Solution Manager Change Management Maintenance Optimizer

SAP Service Marketplace at http://service.sap.com/solman-mopz

The documentation for transaction SAINT (SAP Add-On Installation Tool)

For more information about the implementation of support packages as well as possible side effects, see http://service.sap.com/patches SAP Support Packages in Detail

For more information about the tools necessary for implementing patches, see SAP NetWeaver documentation

5.4 Troubleshooting

5.4.1 Support Desk Management

Support Desk Management enables you to set up an efficient internal support desk for your support organization that seamlessly integrates your end users, internal support employees, partners, and SAP Active Global Support specialists with an efficient problem resolution procedure.

For support desk management, you need the methodology, management procedures, and tools infrastructure to run your internal support organization efficiently.

Security Information

26 December 2016

The following topics are covered:

Remote Support

Component hierarchy relevant for this application

5.4.2 Remote Support Setup

SAP support needs to be able to work remotely for highest efficiency and availability. Therefore all required support tools must be remotely accessible for SAP support. For more information about accessing support remotely, see https://websmp106.sap-ag.de/access-support.

6 Security Information

6.1 Before You Start

While Project Issue and Change Management can be run as a standalone application, it can also be run with other components. Consult the applicable security guides for each one.

Type of Component

Information

SAP NW 7.4 SAP NetWeaver

http://help.sap.com/nw74 Security Information

SAP ERP 6.0 EHP7

http://help.sap.com/erp SAP Enhancement Package 7 for SAP ERP 6.0 Security Information

SAP Adobe Document Server

SAP NetWeaver 7.4

http://help.sap.com/nw74 Application Help Function-Oriented View Adobe Document Services Configuration Guide

For a complete list of the available SAP Security Guides, see http://service.sap.com/securityguide on SAP Service Marketplace.

6.2 Technical System Landscape

December 2016 27

6.2 Technical System Landscape

For more information about the technical system landscape, see the resources listed in the table below and the System Landscape section above.

Topic Guide/Tool Quick Link to the SAP Service

Marketplace or SDN

Technical description of the underlying technological components such as SAP NetWeaver.

Master Guide https://service.sap.com/instguides

High availability High Availability for SAP Solutions

http://sdn.sap.com/irj/sdn/ha

Technical landscape design

See applicable documents

http://sdn.sap.com/irj/sdn/landscapedesign

Security See applicable documents

https://service.sap.com/security

6.3 Additional Information

For more information about specific topics, see the Quick Links as shown in the table below.

Content Quick Link on SAP Service Marketplace or SDN

Security http://sdn.sap.com/irj/sdn/security

Security Guides http://service.sap.com/securityguide

Related SAP Notes http://service.sap.com/notes http://service.sap.com/securitynotes

Released platforms http://service.sap.com/pam

Network security http://service.sap.com/securityguide

SAP Solution Manager http://service.sap.com/solutionmanager

SAP NetWeaver http://sdn.sap.com/irj/sdn/netweaver

6.4 User Administration and Authentication

Project Issue and Change Management uses the user management and authentication mechanisms provided with the SAP NetWeaver platform, in particular the SAP NetWeaver Application Server ABAP. Therefore, the security recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver Application Server ABAP Security Guide [SAP Library] also apply to Project Issue and Change Management.

Security Information

28 December 2016

In addition to these guidelines, we include information about user administration and authentication that specifically applies to the Project Issue and Change Management application in the following topics:

User Management

This topic lists the tools to use for user management, the types of users required, and the standard users that are delivered with the Project Issue and Change Management application.

User Data Synchronization

The Project Issue and Change Management application shares user data with other sources. This topic describes how the user data is synchronized with these other sources.

Integration into Single Sign-On Environments

This topic describes how the Project Issue and Change Management application supports Single Sign-On mechanisms.

6.4.1 User Management

User management for Project Issue and Change Management uses the mechanisms provided with the SAP NetWeaver Application Server (ABAP), for example, tools, user types, and password policies. For an overview of how these mechanisms apply for Project Issue and Change Management, see the sections below. In addition, we provide a list of the standard users required for operating Project Issue and Change Management. User Administration Tools The table below shows the tools to use for user management and user administration with Project Issue and Change Management. User Management Tools

Tool Description

User maintenance for ABAP-based systems (transaction SU01)

For more information about the authorization objects provided by the subcomponents of the Project Issue and Change Management application, see the relevant component in the section Authorizations.

Role maintenance with the profile generator for ABAP-based systems (PFCG)

For more information about the roles provided by the subcomponents of Project Issue and Change Management, see the relevant component in the section Authorizations.

Central User Administration (CUA) for the maintenance of

Use the CUA to centrally maintain users for multiple ABAP-based systems. Synchronization with a directory

6.4 User Administration and Authentication

December 2016 29

Tool Description

multiple ABAP-based systems

server is also supported.

6.4.2 User Data Synchronization

By synchronizing user data, you can reduce effort and expense in the user management of your system landscape. Since Project Issue and Change Management is based on SAP NetWeaver, you can use all of the mechanisms for user synchronization in SAP NetWeaver here. For more information, see the SAP NetWeaver Security Guide at:

6.4.3 Integration into Single Sign-On Environments

The Project Issue and Change Management application supports the Single Sign-On (SSO) mechanisms provided by SAP NetWeaver. Therefore, the security recommendations and guidelines for user administration and authentication as described in the SAP NetWeaver Security Guide [SAP Library] also apply.

The most widely-used supported mechanisms are listed below.

Secure Network Communications (SNC)

SNC is available for user authentication and provides for an SSO environment when using the SAP GUI for Windows or Remote Function Calls.

SAP logon tickets

The Project Issue and Change Management application supports the use of logon tickets for SSO when using a Web browser as the frontend client. In this case, users can be issued a logon ticket after they have authenticated themselves with the initial SAP system. The ticket can then be submitted to other systems (SAP or external systems) as an authentication token. The user does not need to enter a user ID or password for authentication but can access the system directly after the system has checked the logon ticket.

Client certificates

As an alternative to user authentication using a user ID and passwords, users using a Web browser as a frontend client can also provide X.509 client certificates to use for authentication. In this case, user authentication is performed on the Web server using the Secure Sockets Layer Protocol (SSL Protocol) and no passwords have to be transferred. User authorizations are valid in accordance with the authorization concept in the SAP system.

For more information, about the available authentication mechanisms, see User Authentication and Single Sign-On [SAP Library] in the SAP NetWeaver Library.

Security Information

30 December 2016

6.5 Authorizations

The Project Issue and Change Management application uses the authorization concept provided by the SAP NetWeaver AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply to the the Project Issue and Change Management application. The SAP NetWeaver authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP. Standard Roles

The table below shows the standard roles that are used by the Project Issue and Change Management application. The authorization objects for these roles are supplied by SAP in the profiles.

Project Issue and Change Management (CA-CPD-PCM)

Role Description

SAP_SR_CPD_PICM_USER_1

This role provides display authorizations for objects in Project Issue and Change Management (CA-CPD-PCM); and is required for the integrated deployment scenario (integration with CA-CPD).

SAP_SR_PICM_USER_1

This role provides display authorizations for objects in Project Issue and Change Management (CA-CPD-PCM); and is required for the standalone deployment scenario.

SAP_SR_CPD_PICM_PM_1

This role provides create authorization, change authorization, and display authorization for objects in Project Issue and Change Management (CA-CPD-PCM); and is required for the integrated deployment scenario (integration with CA-CPD).

SAP_SR_PICM_PM_1

This role provides create authorization, change authorization, and display authorization for objects in Project Issue and Change Management (CA-CPD-PCM); and is required for the standalone deployment scenario.

The delivered roles must be adjusted in the following way, for the creation and changing of issues, change requests, or activities:

Role Adjustment 1. In the Role Maintenance screen (transaction PFCG), launch the role for

editing.

6.5 Authorizations

December 2016 31

2. In the Authorizations tab, choose Change Authorization Data.

3. Under the authorization hierarchy for Commercial Project Management, navigate to the corresponding authorization object of the business object Activity.

4. Choose Change to set the attributes for this authorization field.

5. To allow the creation of the business object, select the change authorization.

6. Save the role authorization.

Authorization Objects

The table below shows the authorization objects that are used by the Project Issue and Change Management application.

Authorization Object

Description

PICM_STAT Authorization object to check if the user has the authority to change lifecycle status of the activity

PICM_ISTAT Authorization object to check if the user has the authority to change lifecycle status of the issue or change request

/IAM/OREF Authorization object for Reference Objects for Issue, Change Request, and Activity

IAM_CAT_AC Authorization to Restrict Access to Project Issue and Change Management Worklist Object

/IAM/AAUTH Authorization Object for Activity

/IAM/ATTMT Authorization Object for Attachments for Issue and Activity

/IAM/A_ATTR Authorization Object for Attribute Maintenance for Activity

IAM_CODEGR Authorization Object for Code Groups

/IAM/TXTTY Authorization Object for Descriptions

/IAM/IAUTH Authorization Object for Issue Requests

IAM/A_STAT Authorization Object for Lifecycle Status (Activity)

IAM/I_STAT Authorization Object for Lifecycle Status (Issue)

Security Information

32 December 2016

Authorization Object

Description

IAM/A_RLCD Authorization Object for Role Codes in Activity

IAM/I_RLCD Authorization Object for Role Codes in Issue

/IAM/CODGR Authorization Object for Selection of Code Groups, Codes

For more information about the authorization objects required for the deployment of Project Issue and Change Management as an add-on on SAP ERP, see the administrator’s guide for CPD 2.0 (in the Authorizations chapter).

6.6 Session Security Protection

To increase security and prevent access to the SAP logon ticket and security session cookies, it is recommended that you activate secure session management. We also highly recommend using SSL to protect the network communications where these security-relevant cookies are transferred.

Session Security Protection on the AS ABAP

The following section is relevant for Project Issue and Change Management in SAP NetWeaver Business Client: To prevent access in javascript or plug-ins to the SAP

logon ticket and security session cookies (SAP_SESSIONID_<sid>_<client>). You

can activate secure session management. With an existing security session, users can then start applications that require a user logon without logging on again. When a security session is ended, the system also ends all applications that are linked to this security session.

Use the transaction SICF_SESSIONS to specify the following parameter values shown

in the table below in your AS ABAP system:

Session Security Protection Profile Parameters

Profile Parameter Recommended Value

Comment

icf/set_HTTPonly_flag_on_cookies 0 Client-dependent

login/ticket_only_by_https 1 Not client-dependent

6.7 Network and Communication Security

December 2016 33

6.7 Network and Communication Security

Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business needs without allowing unauthorized access.

A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the backend system’s database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.

The network topology for the Project Issue and Change Management application is based on the topology used by the SAP NetWeaver platform. Therefore, the security guidelines and recommendations described in the SAP NetWeaver Security Guide also apply to the Project Issue and Change Management application. Details that specifically apply are described in the following topics:

Communication Channel Security

This topic describes the communication paths and protocols used by the Project Issue and Change Management application.

Network Security

This topic describes the recommended network topology for the Project Issue and Change Management application It shows the appropriate network segments for the various client and server components and where to use firewalls for access protection. It also includes a list of the ports needed to operate the Project Issue and Change Management application.

Communication Destinations

This topic describes the information needed for the various communication paths, for example, which users are used for which communications.

For more information, see the following sections in the SAP NetWeaver Security Guide:

Network and Communication Security [SAP Library]

Security Aspects for Connectivity and Interoperability [SAP Library]

Security Information

34 December 2016

6.7.1 Communication Channel Security

The table below shows the communication channels used by the Project Issue and Change Management application, the protocol used for the connection and the type of data transferred.

Communication Path Protocol Used

Type of Data Transferred

Data Requiring Special Protection

Frontend client using SAP GUI for Windows to application server

RFC,

HTTP(S) Integration data Passwords

Frontend client using a Web browser to application server

HTTPS All application data Passwords

Application server to third-party application

HTTPS System ID, client, and host name

System information (that is, host name)

Application server to application server

RFC

Application data (equipment, functional locations) integration objects

System information

DIAG and RFC connections can be protected using Secure Network Communications (SNC). HTTP connections are protected using the Secure Sockets Layer (SSL) protocol.

For more information, see Transport Layer Security in the SAP NetWeaver Security Guide.

6.7.2 Network Security

Your network infrastructure plays a key role in protecting your system. A well-defined network topology can eliminate many security threats based on software flaws (at the operating system and application level) or network attacks such as eavesdropping. We offer general recommendations to protect your system landscape, based on SAP NetWeaver.

NOTE

For information about network security for SAP NetWeaver, see the SAP NetWeaver Security Guide on SAP Service Marketplace at http://service.sap.com/securityguide. A minimum security demand for your network infrastructure is the use of a firewall for all your services that are provided over the Internet. A more secure variant is to protect your systems (or groups of systems) by locating the system groups in different network

6.7 Network and Communication Security

December 2016 35

segments. Each system group has a firewall that protects it from unauthorized access. External security attacks can also come from the inside, if the intruder has already taken control of one of your systems. NOTE

For information about access control using firewalls, see the SAP NetWeaver Security Guide on SAP Help Portal at:

SAP NW 7.4 SAP NetWeaver

http://help.sap.com/nw74 Security Information Security Guide Network and Communication Security Using Firewall Systems for Access Control

Security Information

36 December 2016

6.7.3 Communications Destinations

The use of users and authorizations in an irresponsible manner can pose security risks. You should therefore follow the security rules below when communicating with other systems:

Employ the user types system and communication.

Grant a user only the minimum authorizations.

Choose a secure password and do not divulge it to anyone else.

Only store user-specific logon data for users of type system and communication.

Wherever possible, use trusted system functions instead of user-specific logon data.

For navigation with NWBC for Desktop, it is necessary to make entries in table

HTTP_WHITELIST.

6.8 Data Storage Security

Using Logical Paths and File Names to Protect Access to the File System The Project Issue and Change Management component saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs. Activating the Validation of Logical Paths and File Names The logical paths and file names are entered in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-dependent). To determine

which paths are used by your system, you can activate the appropriate settings in the Security Audit Log.

6.9 Data Archiving

December 2016 37

For information about data storage security, see:

SAP NW 7.4 SAP NetWeaver

http://help.sap.com/nw74 Security Information Security Guide Security Guides for the Operating System and Database Platforms

6.9 Data Archiving

6.9.1 Archiving Issues and Change Requests with /PICM/BO_I

You can use the archiving object Issues and Change Requests (/PICM/BO_I) to archive issues and change requests that are no longer needed. Archiving allows you to reduce the load on your database.

6.9.1.1 Structure

6.9.1.1.1 Tables

The system archives data from the following tables:

Table Description

/BOBF/D_ATF_DO Document node of attachment folder

/BOBF/D_ATF_RT Root nodes of attachment folder

/BOBF/D_TXCCON Text content

/BOBF/D_TXCROOT Root node of text collection

/BOBF/D_TXCTXT Text

/IAM/D_I_ATT Attachment

/IAM/D_I_DATE Date

/IAM/D_I_DESC Description node

/IAM/D_I_DESC_TX Language-dependent description text node

/IAM/D_I_OBJ_REF Issue reference node

Security Information

38 December 2016

/IAM/D_I_OREF_DT Language-dependent, reference, description text node

/IAM/D_I_PARTY Party node

/IAM/D_I_QTY Quantity

/IAM/D_I_ROOT Root node

6.9.1.1.2 Programs

The following programs are available for /PICM/BO_I:

Preprocessing Program: /PICM/ARCH_ISSUE_CR_ROOT_PRE

This program checks if an object is ready for archiving by verifying the following conditions:

o The adherence to the specified residence time

o The availability of activities for the object

If the object is ready, this program sets the status as Archiving in Process (02) in the database. After the preprocessing program has run, the objects marked for archiving are no longer made available on the UI.

Write Program: /PICM/ARCH_ISSUE_CR_ROOT_WRITE

This program checks if an object has the status Archiving in Process (02). If the status is 02, the program archives the object to the archive file.

Delete Program: /PICM/ARCH_ISSUE_CR_ROOT_DEL

This program verifies archived files against the data in the database; and deletes all objects in the database that have been successfully archived.

6.9.1.2 More Information

To change the residence time, make settings in Customizing for Cross-Application Components under Processes and Tools for Enterprise Applications Reusable Objects and Functions for BOPF Environment Archiving Adapter Maintain BO-Specific Residence Periods.

6.9.2 Archiving Activities with /PICM/BO_A

You can use the archiving object Activities (/PICM/BO_A) to archive activities that are no longer needed. Archiving allows you to reduce the load on your database.

6.9.2.1 Structure

6.9.2.1.1 Tables

6.9 Data Archiving

December 2016 39

The system archives data from the following tables:

Table Description

/BOBF/D_ATF_DO Document node of attachment folder

BOBF/D_ATF_RT Root nodes of attachment folder

/BOBF/D_TXCCON Text content

/BOBF/D_TXCROOT Root node of text collection

/BOBF/D_TXCTXT Text

/IAM/D_ACT_ROOT Root

/IAM/D_ACT_ATT Attachment

/IAM/D_ACT_DATE Date

/IAM/D_ACT_DESC Description

/IAM/D_ACT_DTXT Description text

/IAM/D_ACT_FOA Follow-up action

/IAM/D_ACT_FOA_P Follow-up action parameter

/IAM/D_ACT_OBJ_RF Object reference

/IAM/D_ACT_OREF_DT Language-dependent description texts

/IAM/D_ACT_PARTY Party

/IAM/D_ACT_QTY Activity quantity

6.9.2.1.2 Programs

The following programs are available for /PICM/BO_A:

Preprocessing Program: /PICM/ARCH_ACTIVITY_ROOT_PPROC

This program checks if an object is ready for archiving by verifying the adherence to the specified residence time. If the object is ready, this program sets the status as Archiving in Process (02) in the database. After the preprocessing program has run, the objects marked for archiving are no longer made available on the UI.

Security Information

40 December 2016

Write Program: /PICM/ARCH_ACTIVITY_ROOT_WRITE

This program checks if an object has the status Archiving in Process (02). If the status is 02, the program archives the object to the archive file.

Delete Program: /PICM/ARCH_ACTIVITY_ROOT_DEL

This program verifies archived files against the data in the database; and deletes all objects in the database that have been successfully archived.

6.9.2.2 More Information

To change the residence time, make settings in Customizing for Cross-Application Components under Processes and Tools for Enterprise Applications Reusable Objects and Functions for BOPF Environment Archiving Adapter Maintain BO-Specific Residence Periods.

6.10 Data Protection

Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different countries. This section describes the specific features and functions that SAP provides to support compliance with the relevant legal requirements and data privacy.

This section and any other sections in this Security Guide do not give any advice on whether these features and functions are the best method to support company, industry, regional or country-specific requirements. Furthermore, this guide does not give any advice or recommendations with regard to additional features that would be required in a particular environment; decisions related to data protection must be made on a case-by-case basis and under consideration of the given system landscape and the applicable legal requirements.

Note

In the majority of cases, compliance with data privacy laws is not a product feature.

SAP software supports data privacy by providing security features and specific data-protection-relevant functions such as functions for the simplified blocking and deletion of personal data.

SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken from any given legal source.

Glossary

Term Definition

Personal data Information about an identified or identifiable natural person.

6.10 Data Protection

December 2016 41

Business purpose A legal, contractual, or in other form justified reason for the processing of personal data. The assumption is that any purpose has an end that is usually already defined when the purpose starts.

Blocking A method of restricting access to data for which the primary business purpose has ended.

Deletion Deletion of personal data so that the data is no longer usable.

Retention period The time period during which data must be available.

End of purpose (EoP) A method of identifying the point in time for a data set when the processing of personal data is no longer required for the primary business purpose. After the EoP has been reached, the data is blocked and can only be accessed by users with special authorization.

Some basic requirements that support data protection are often referred to as technical and organizational measures (TOM). The following topics are related to data protection and require appropriate TOMs:

Access control: Authentication features as described in section User Administration and Authentication.

Authorizations: Authorization concept as described in section Authorizations.

Availability control as described in:

Section Data Storage Security

SAP NetWeaver Database Administration documentation

SAP Business Continuity documentation in the SAP NetWeaver Application Help under Function-Oriented View -> Solution Life Cycle Management -> SAP Business Continuity

Separation by purpose: Is subject to the organizational model implemented and must be applied as part of the authorization concept.

Caution

The extent to which data protection is ensured depends on secure system operation. Network security, security note implementation, adequate logging of system changes, and appropriate usage of the system are the basic technical requirements for compliance with data privacy legislation and other legislation.

Configuration of Data Protection Functions

Certain central functions that support data protection compliance are grouped in Customizing for Cross-Application Components under Data Protection.

Additional industry-specific, scenario-specific or application-specific configuration might be required.

Security Information

42 December 2016

For information about the application-specific configuration, see the application-specific Customizing in SPRO.

6.10.1 Deletion of Personal Data

Use

Project Issue and Change Management (CA-CPD-PCM)

Project Issue and Change Management might process data (personal data) that is subject to the data protection laws applicable in specific countries as described in SAP Note 1825544.

The SAP Information Lifecycle Management (ILM) component supports the entire software lifecycle including the storage, retention, blocking, and deletion of data. The Project Issue and Change Management application (CA-CPD-PCM) uses SAP ILM to support the deletion of personal data as described in the following sections.

End of Purpose Check (EoP)

An end of purpose check determines whether data is still relevant for business activities based on the retention period defined for the data. The retention period of data consists of the following phases.

Phase one: The relevant data is actively used.

Phase two: The relevant data is actively available in the system.

Phase three: The relevant data needs to be retained for other reasons.

o For example, processing of data is no longer required for the primary business purpose, but to comply with legal rules for retention, the data must still be available. In phase three, the relevant data is blocked.

o Blocking of data prevents the business users of SAP applications from displaying and using data that may include personal data and is no longer relevant for business activities.

Blocking of data can impact system behavior in the following ways:

Display: The system does not display blocked data.

Change: It is not possible to change a business object that contains blocked data.

Create: It is not possible to create a business object that contains blocked data.

Copy/Follow-Up: It is not possible to copy a business object or perform follow-up activities for a business object that contains blocked data.

Search: It is not possible to search for blocked data or to search for a business object using blocked data in the search criteria.

6.10 Data Protection

December 2016 43

It is possible to display blocked data if a user has special authorization; however, it is still not possible to create, change, copy, or perform follow-up activities on blocked data.

SAP delivers an end of purpose check for Project Issue and Change Management. The delivered end of purpose function module is /PICM/BUPA_EOP_CHECK.

Integration with Other Solutions

In the majority of cases, different installed applications run interdependently as shown in following graphic.

Example of interdependent applications

An example of an application that uses central master data is an SAP for Healthcare (IS-H) application that uses the purchase order data stored in Financial Accounting (FI) or Controlling (CO).

Relevant Application Objects and Available Deletion Function

Application Detailed Description

Provided Deletion Function

Project Issue and Change Management

Project Issue and Change Management stores personal information of business partners for the Partner function.

The ILM-enabled deletion program for issues and change requests: /PICM/ARCH_ISSUE_CR_ROOT_DEL

The ILM-enabled deletion program for activities: /PICM/ARCH_ACTIVITY_ROOT_DEL

Solution-Wide Topics

44 December 2016

6.11 Security-Relevant Logging and Tracing

The trace and log files of Project Issue and Change Management use the standard mechanisms of SAP NetWeaver. For more information, see the following sections in the SAP NetWeaver Security Guide at:

SAP NW 7.4 SAP NetWeaver

http://help.sap.com/nw74 Security Information Security Guide Security Aspects for Lifecycle Management Auditing and Logging

If there is no information about trace and log files in the sections for the individual components of Project Issue and Change Management, you can assume that no sensitive data is updated in these files.

7 Solution-Wide Topics

7.1 List of References

The following table lists references to technologies used for Project Issue and Change Management:

Web Dynpro ABAP and Floorplan Manager

http://help.sap.com/nw74 Application Help Function-Oriented View UI Technologies in SAP NetWeaver Web Dynpro ABAP and Floorplan Manager

7.2 Application Program Interfaces (APIs)

The following table lists APIs that can be used as alternatives to the application:

Technical Name Description

/PICM/FM_ISSUE_CR_CREATE_NEW You can use this API to create issues with all nodes.

/PICM/FM_ISSUE_CR_UPDATE_API You can use this API to update issues and change requests.