A secure deployment can drift over time. A one-off review does not detect new destinations, trust relationships or relaxed ACLs.
From local review to central monitoring
SM59 and RSRFCCHK support analysis within an individual system. Configuration Validation in SAP Solution Manager and Configuration & Security Analysis in SAP Focused Run provide a central view across larger landscapes.
Destination, parameter and ACL data is collected periodically and compared with configuration templates. Dashboards and alerting support review of deviations.
Central review scope
| Configuration item | Coverage |
|---|---|
RFCDES | Destination details. |
RFCDES_TYPE_3_CHECK | Stored credentials, trusted logon, target-user authorizations and SNC. |
RFCSYSACL | Trust relationships. |
ABAP_INSTANCE_PAHI | Required profile parameter settings. |
GW_REGINFO, GW_SECINFO | Gateway ACLs. |
These identifiers represent monitoring configuration items; they are not all SAP transaction codes.
Logs support control maintenance
Logging provides an audit trail and helps build access rules. Starting early improves coverage of infrequent but necessary processes. Where available, simulation helps assess the effect of restrictions before enforcement.
Assign each deviation to a destination or control owner, document the decision and verify the result after a change.
Review checklist
- Define target settings for destinations, trust, parameters and ACLs.
- Identify systems covered by data collection.
- Review deviations and assign responsibility.
- Repeat the assessment after configuration changes and upgrades.