Separate requirements by technology
ECS requirements are defined separately for ABAP, HANA and Java. During a review, distinguish the application platform, database and integration components. Assign a maintenance owner to each group of settings.
Profiles and effective values
ECS security parameters are maintained in DEFAULT.PFL. Compare the target configuration with the effective value on every instance. Account for instance-profile overrides and dynamic changes.
Example review points
Check auth/rfc_authority_check=6, auth/check/calltransaction=3, rfc/callback_security_method=3, rfc/allowoldticket4tt=no, gw/rem_start=DISABLED and snc/permit_insecure_start=0. Also include login/disable_cpic=1, rdisp/TRACE_HIDE_SEC_DATA=ON and DBA Cockpit restrictions.
Agreeing the change
Prepare a list of deviations with their business and technical impact. Coordinate changes with the responsible operations team and CDM, TSM or CAA roles. After deployment, verify the effective configuration and integration behavior.
Controls to review
Service exposure and network configuration
Restrict unnecessary services, remote calls and access to internal communication.
Gateway registration, startup and proxy
Restrict connections to external RFC servers and disable simulation after rollout.
Trust between systems
Maintain only required trust relationships and control their use.
SNC, TLS and internal communication
Authenticate and encrypt communication across untrusted networks.
Production and transport protection
Lock down production changes and retain a configuration change trail.