Sensitive Transactions List for Production System

Question

We are looking for a comprehensive list of sensitive transactions (e.g. SE38, SE37, LSMW, etc) that should NOT be assign in Production environment. Transactions that will trigger audit violation in PRD environment. Hopefully with documentations or whitepapers to backup this list.
Thanks,
Lye

Answer 1

They could only access data from SE16 if they have the corresponding s_tabu_dis activity for the authorization group to which that table has been assigned.
If the auth group is not maintained, SE16 will assign the value '&NC&' to it and check it.
If granting s_tabu_dis for other tables sharing the same auth group is inappropriate, then these can be re-assigned in transaction SUCU.
I still don't see where SE16 or SM30 itself are problems if the user has correct authorizations.
Infact, if a user must view / maintain a table, it is much safer and cheaper to use SE16 / Sm30 than re-invent them and hardcode the table name.
*       FORM AUHTORITY_CHECK_AGAIN                                    *
FORM AUTHORITY_CHECK_AGAIN USING ACT.
  GLOBAL_AUTH = 'SHOW'.
  SELECT SINGLE * FROM TDDAT WHERE TABNAME = DATABROWSE-TABLENAME.
  IF SY-SUBRC <> 0  OR  TDDAT-CCLASS = SPACE.
    TDDAT-CCLASS = '&NC&'.             " 'non classified table'
  ENDIF.
* Anzeigeberechtigung
  AUTHORITY-CHECK OBJECT 'S_TABU_DIS'
           ID 'DICBERCLS' FIELD TDDAT-CCLASS
           ID 'ACTVT' FIELD '03'.
  IF SY-SUBRC NE 0.
    MESSAGE E419 RAISING NO_PERMISSION.
  ENDIF.
* Änderungsberechtigung
  AUTHORITY-CHECK OBJECT 'S_TABU_DIS'
           ID 'DICBERCLS' FIELD TDDAT-CCLASS
           ID 'ACTVT' FIELD '02'.
  IF SY-SUBRC = 0.
    GLOBAL_AUTH = 'UPDA'.
  ELSE.
    IF ACT = 'ANLE'.
      MESSAGE E417 RAISING NO_PERMISSION.
    ENDIF.
  ENDIF.
  IF DD02L-CLIDEP EQ SPACE.
*  Mandnatenunabhängig
    AUTHORITY-CHECK OBJECT 'S_TABU_CLI'
                    ID 'CLIIDMAINT' FIELD 'X'.
    IF SY-SUBRC <> 0.
*      Keine Berechtigung für mandantenunabhängige Änderungen
      GLOBAL_AUTH = 'SHOW'.
      IF ACT = 'ANLE'.
        MESSAGE E417 RAISING NO_PERMISSION.
      ENDIF.
    ENDIF.
  ENDIF.
ENDFORM.