Security Hardening, Audit Logging and Security Notes

Keep this: job aid

ABAP security operations card

• Baseline first: SAP's template plus Note 2253549 recommendations; check every system against it.
• Logon: password parameters, SECPOL policies, RSUSR_LOCK_USERS for inactive users.
• Standard users: SAP* record kept and locked, login/no_automatic_user_sapstar above 0, DDIC and EARLYWATCH protected.
• RFC: narrow S_RFC, no powerful stored credentials, gateway access control maintained.
• Audit log: rsau/enable on; critical events for all, everything for privileged users; weekly recorded review.
• Critical access: named list, monthly reconciliation, emergency access for privileged work.
• Patch Day: second Tuesday monthly; triage by relevance, severity (CVSS 7.0+ high) and exposure.
• Test notes: manual steps, new checks, interfaces; switchable authorization scenarios.
• Evidence: system-generated, dated, system and client shown; design plus operating records; never backdate.