Installation versus upgrade
New installations, system copies and conversions covered by Secure by Default receive the appropriate security settings. Upgrading an existing S/4HANA or BW/4HANA system does not automatically adjust every setting. Configuration review is therefore a separate post-upgrade activity.
RSPFRECOMMENDED and RZ11
Run RSPFRECOMMENDED or open Goto → All recommended values in RZ11. For each deviation, establish what the parameter controls, its business impact and the preparation needed before changing it. Apply approved settings and verify the result again.
Controls beyond profile parameters
Include PRGN_CUST, transport parameters, UCON HTTP rules, SACF and SLDW scenarios, and HANA auditing. Check BNAME_RESTRICT=XXX, US_ASGM_TRANSPORT=NO, USER_REL_IMPORT=NO and REF_USER_CHECK=E. A review limited to system profiles will not cover these controls.
Preparing for enforcement
Before changing callback, SNC or access rules, collect integration requirements and test the affected processes. Define an owner, evidence of correct operation and a rollback approach for each change. Use configuration appropriate to the release and kernel.
Controls to review
Production and transport protection
Lock down production changes and retain a configuration change trail.
Execution controls and system accounts
Maintain control over operations and operating system account privileges.
Service exposure and network configuration
Restrict unnecessary services, remote calls and access to internal communication.
Role assignments and transports
Separate the transport of role definitions from granting access to individuals.
Security Audit Log and platform auditing
Record events needed for incident detection and retrospective analysis.