haven SAP Security
Browse knowledge
Knowledge base
NOTEST / SECURITY BASELINE

Test functionality in production

Remove development and testing capabilities from routine operational access.

Risk

Arbitrary execution of test functions and methods can bypass normal business processes.

JavaABAP

Settings and priorities

Technology / priorityParameter or mechanismSetting and purpose
Java
Critical
EnableInvokerServletGloballyfalse
Disables Invoker Servlet in servlet_jsp.
ABAP
Critical
S_DEVELOP · FUGR/CLAS · ACTVT 16Strictly limited scope
Controls test execution of functions and methods; CRITAU-A.
ABAP
Standard
SICF · test servicesInactive unless required
Related to NETCF-A.

How to verify

  1. Check global servlet_jsp configuration.
  2. Review roles that permit test execution.
  3. Define a controlled emergency access process.

Related topics

RFC · RFC client-side controls ↗

System hardening ↗

Baseline priorities and implementation ↗