sap-compliance-docsMap an SAP landscape or subscription to the governance, certification and usage-rights documents that apply to it — the Trust Center Compliance Finder, the certification catalogue (ISO 27001/27017/27018/27701/42001, SOC 1/2 and bridge letters, C5, PCI DSS, CSA STAR, TISAX, GxP, FedRAMP, IRAP, NIS2), AI governance, ALM usage rights (Cloud ALM, Solution Manag…
Independent GitHub snapshot · Automated classification · Original documentation governs
Auditors, procurement and security reviews all ask the same question in different words: "prove this SAP service is certified / covered / licensed." The answer is always a specific document, and the work is knowing which one and where it lives.
Guardrail — this skill FINDS documents. It does not interpret them.
- Never assert an entitlement, licence position, or compliance status from memory. Produce the document reference and quote it. If no document is found, say so.
- Never give legal, contractual or audit advice. Certification scope, contract terms and audit sufficiency are decisions for the customer's legal/compliance function and their SAP account executive / Customer Success Partner — route them there explicitly.
- Licence questions go to SAP. Usage rights (§6) summarise a published page; anything contested, partner-specific, or money-adjacent goes to the account executive or SAP Order Management.
- Certificates are scoped and dated. A certificate covering SAP Enterprise Management does not automatically cover every SAP product you run. Always check the Statement of Applicability (SoA) version and the assessment period — §2.
- Public vs entitled. Some documents are public; others require sign-in and an entitlement. Don't promise a customer a document you haven't confirmed they can obtain — §3.
Verification legend: [V] verified against the live source during authoring · [G] cited to a page or Note.
The Trust Center's Compliance Finder is the authoritative index, and its own glossary defines the dimensions: [V, FIND]
| Dimension | What it means (SAP's wording) |
|---|---|
| Compliance Offering | "the ISO, SOC, or one of the various other compliance offering type[s] needed" |
| Compliance Entity | "the list of cloud solutions from SAP and related SAP services or functions" |
| Assessment Period / Issue Date | "the period of the assessment or the issue date of the document" |
| Region / Country | "the country where the SAP data center is located" |
🚨 The single most common mistake: searching for your product name. Certificates are issued to a Compliance Entity, which is usually a group of solutions. For example an ISO 27011 certificate on the finder covers "SAP Integrated Business Planning, SAP Marketing Cloud and SAP S/4HANA Cloud Public Edition" as one entity, and an ISO 22301 certificate covers SAP Intelligent Spend and Business Network including "SAP Ariba Cloud, SAP Business Network, SAP Concur Travel & Expenses, and SAP Fieldglass". Find the entity that contains your service, then filter by offering. [V, FIND]
SAP's own advice: "Using the 'Offering Type', 'Compliance Entity', and 'Assessment Period/Issue Date' filters instead of the search bar is the recommended and best way to locate your compliance documents." [V, FIND]
Every certificate entry carries scope wording — and that wording is the deliverable, not the certificate logo. Real examples from the finder: [V, FIND]
Three things to extract every time:
| Source | Contains | Access |
|---|---|---|
| Trust Center → Compliance Finder | the public index — 376 documents at time of authoring | Public browse; many documents are "available for request on this page" |
| SAP for Me → Portfolio & Products | "the central access point and the go-to destination for existing SAP customers to download eligible compliance documents on demand" | Sign-in; entitlement-based |
| My Trust Center (support.sap.com) | announcements, report calendars, enablement resources | S-user sign-in |
| Scheme registries | e.g. TISAX via ENX, FedRAMP Marketplace, EU Cloud CoC public register | Public, third-party |
Compliance Finder:
https://www.sap.com/about/trust-center/certification-compliance/compliance-finder.html
It accepts a deep-link tag per offering — useful for handing an auditor a precise link: [V, FIND]
…/compliance-finder.html?tag=compliance-document:compliance-offering/<offering>
Offering slugs verified live: iso-42001, iso-9001, iso-27001, iso-27017, iso-27018, bs-10012,
iso-14001, iso-50001, iso-22301, soc-1, soc-2, soc-1-bridge-letter, soc-2-bridge-letter,
pci-dss, gxp, csa-star, c5, canadian-cloud-compliance. [V, FIND]
Full catalogue and link table: references/compliance-catalogue.md
Publication cadence — SAP publishes a SOC & C5 Performance Calendar; at time of authoring it stated SOC 1 reports are targeted for publication within 90 days after each performance period, and SOC 2 reports follow a 12-month audit cycle. Check the current calendar rather than quoting these dates. [V, CERT]
⚠️ Report consolidation happens. SAP announced SAP Central Cloud Services SOC 1, SOC 2 and C5 reports that "replace the previous SOC 1 SAP Business Technology Platform, SAP Cloud Infrastructure, and SAP Cell and Gene Therapy Orchestration and SAP Intelligent Clinical Supply Management reports." If an auditor asks for a report by an old name, it may have been folded into a newer one. [V, CERT]
| Item | What it is |
|---|---|
| ISO/IEC 42001 | "the first global standard for AI management systems" — SAP is certified; "a structured, independently audited AI management system" [V, CERT] |
| EU AI Act governance for Joule Agents | SAP publishes how it governs its AI agents — "auditability, regulatory compliance, and human oversight under the EU AI Act" — in the SAP Joule Agents Compliance Brief [V, CERT] |
Because this area changes fastest, always re-read the Trust Center AI section rather than relying on this skill's summary, and treat any statement about a specific Joule capability's regulatory classification as something to confirm in the current brief.
Certification answers "is it secure/compliant". The contract documents answer "what did we actually buy, and what is SAP obliged to deliver". Different question, different library.
An SAP cloud contract has four building blocks — SAP's own wording: [V, AGR]
| Block | Scope |
|---|---|
| Order Form | pricing, scope, key terms |
| Cloud Service Description | "a product-specific collection of documents" — this is where the Service Description Guide (SDG) lives |
| Data Processing Agreement (DPA) | applies where the service processes personal data; "defines SAP's obligation to maintain applicable certifications" |
| General Terms and Conditions (GTC) | usage rights, ownership of customer data, warranties, limitation of liability, confidentiality |
"The order form, data processing agreement, and general terms and conditions apply to any cloud service on SAP's pricelist while the cloud service description is a product-specific collection of documents." [V, AGR]
🔗 The DPA is the bridge between §1–4 and this section. It obliges SAP to maintain applicable certifications — so a certificate from the Compliance Finder is often the evidence that a DPA commitment is being met. Auditors frequently ask for both together.
https://www.sap.com/about/trust-center/agreements/cloud/cloud-services.html
?tag=agreements:product_use_and_support_terms/service-description-guides
Real entries at time of authoring — note the naming: [V, AGR]
| Document | Version |
|---|---|
| SAP Business Technology Platform Service Description Guide | ENGLISH v.5-2026 |
| SAP Cloud ERP Private; RISE with SAP S/4HANA Cloud, private edition; SAP ERP, private cloud edition SDG | ENGLISH v.7-2026 |
| SAP S/4HANA Cloud Public Edition and GROW with SAP — Service Use Descriptions | ENGLISH v.7-2026 |
| SAP Business Data Cloud SDG · SAP Concur SDG | ENGLISH v.8-2026 |
| SAP Service Description for SAP MaxAttention / ActiveAttention (on-premises) | v.3-2026 |
🚨 SDGs are versioned
LANGUAGE v.N-YEAR, and the current one is probably not yours. The version that governs is the one referenced in the customer's order form, not the newest on the site. Always confirm the version before quoting an obligation — and note that several products share one SDG (RISE / Cloud ERP Private / SAP ERP private cloud edition are covered by a single document). [V, AGR]
All under …/trust-center/agreements/cloud/cloud-services.html with a tag or search: [V, AGR]
| Document type | What it settles |
|---|---|
| Service Description Guides | functional scope of the service |
| Supplements | "additional product-specific terms … additional information on the usage metrics" |
| Service Level Agreements | "system availability … service credits in case SAP fails to meet the SLA … maintenance windows" |
| Support schedules | support scope and response commitments |
| Product development schedules | roadmap/development commitments |
| Data Processing Agreements | personal-data processing |
| Security measures (TOMs) | technical & organisational measures for DPA purposes |
| List of data centers | where the service runs — pairs with the finder's Region/Country filter |
| AI terms, AI Code of Conduct, AI third-party pass-through terms | AI-specific contractual terms — the contractual counterpart to §5's ISO 42001 / EU AI Act material |
Framework agreement: the Master Cloud Customer Agreement (MCCA) is "a framework agreement … that apply[ies] across most of the SAP cloud services portfolio, eliminating the need to negotiate separate terms for each service." Samples of the MCCA, its order form and the professional services schedule are published; customers can request to sign the standard MCCA through SAP for Me. [V, AGR]
On-premise and services have their own libraries: …/agreements/on-premise/service-descriptions.html,
…/agreements/services/scope-documents.html, and separate DPA/TOM documents for support and professional
services.
Contract administration — view, renew and terminate contracts in SAP for Me → Finance and Legal Dashboard. [V, AGR]
A different question from certification: "are we entitled to run this, and does it cost extra?" The authoritative page is support.sap.com → ALM → Usage Rights; the following is verbatim-grounded but must be re-checked before you act on it — terms and dates change. [V, ALM]
| Product | Entitlement | Key limits |
|---|---|---|
| SAP Cloud ALM | Included in SAP Cloud Service subscriptions containing Enterprise Support, cloud editions, in SAP Enterprise Support, and in Product Support for Large Enterprises. Entitles one tenant | Only for the customer's own internal ALM processes, and only for on-prem solutions covered by their support agreement. Baseline 24 GB HANA memory and 24 GB monthly outbound API data transfer |
| SAP Solution Manager | Delivered as part of the support contract — scope depends on the maintenance agreement and is independent of the SolMan release. No need to license users for standard usage | Includes Focused Build and Focused Insights "at no additional costs". Includes SAP ASE and SAP HANA licences strictly limited to SolMan (no hardware or services) |
| SAP Focused Run | "Sold by SAP Sales Organization" — i.e. licensed separately; not part of the support contract | FRUN customers "can manage their whole IT (including non-SAP Components)" |
| Tricentis Test Automation for SAP | Term licence granted with Enterprise Support / PSLE. With Cloud ALM granted until 31 Dec 2028; with Solution Manager until 31 Dec 2027 | With Cloud ALM: 5 named users, 500 test runs/month, 2.5 GB storage, 5 customer-managed execution agents, 12-month result retention. Not available for customers in China |
Enterprise Support vs Standard Support for Solution Manager — the practical difference: [V, ALM]
⚠️ Two constraints that catch people out: Test Suite / test management in both SolMan and Cloud ALM "may not be used for automation of productive business processes" — they are for testing and validating business processes only. And SAP Partners may have different usage-rights definitions — the page says to contact your SAP partner manager. [V, ALM]
The Enterprise Support scope also applies to Product Support for Large Enterprises and premium engagements such as SAP ActiveAttention. [V, ALM]
A repeatable sequence — the deliverable is a table of documents, not an opinion:
Deliverable shape:
| Service | Compliance entity | Offering | Document + SoA/period | Source | Obtainable |
|---|---|---|---|---|---|
| SAP SuccessFactors HCM | SAP SuccessFactors | ISO 27701 | cert, SoA v2.6, 2025-10-15 | Compliance Finder | public |
| … | … | SOC 2 Type II | report + bridge letter | SAP for Me | entitled |
Not applicable — this skill is entirely OS-independent. It concerns published documents and portal
navigation, with no commands on any platform. It is included in sap-basis-ops because the person asked
to produce audit evidence for a landscape is usually the same person who administers it.
sap-software-download — entitlement-gated downloads in SAP for Me; the same S-user and portal.sap-client-copy-accelerator — §0a: why a HANA Smart Data Access licence answer lives in the SDG, not in an SAP Note.sap-oracle-dataguard — Oracle option licensing (Notes 740897 / 581312) for the database layer.sap-sscr-keys — the other SAP for Me entitlement workflow.sap-support-case — the support entitlement behind what you may raise, and at what priority.Every command executed must be traceable to one of exactly three things:
If a command is backed by none of those, do not run it — say what backing is missing and stop. "It's probably fine", "this is standard", and "I recall the syntax" are not backing. When the backing is a source, name it (page or Note number) alongside the command; when it is the user, quote the instruction.
If executing would require assuming anything the user did not state, you are obliged to confirm first. Never fill a gap with a plausible default. Common gaps that force a stop:
A wrong assumption here is not a typo — it is the difference between reading a log and stopping production.
Asking the user for something the system can answer is a failure. Before you raise a question, ask the user to go and look, or request Computer Use / GUI access, you must first try to determine it programmatically. Only what genuinely cannot be derived — intent, authorization, a business decision, a value that exists only in the user's head — is a legitimate question.
| Determine programmatically (do NOT ask) | Ask the user (cannot be derived) |
|---|---|
Which DB — echo $dbms_type, profile dbms/type | Which client to act on |
SIDs / instances / hosts / ports — sapcontrol … GetSystemInstanceList, ls /usr/sap | Whether this system is in scope / approved |
Is it up, is the DB up — GetProcessList, R3trans -d | PRD change approval, downtime window |
Kernel / release / patch — disp+work -version, saphostexec -version | The intended recovery point or retention policy |
Which clients exist — table T000 | Which of those clients is meant |
Free space, log locations, parameter values — df -h, sappfpar, profile | Business impact / urgency |
Order, always: verify programmatically → ask only what remains → never assume.
Work down this ladder. Take the highest rung that does the job — and within that rung, the lowest privilege that suffices. Never skip a rung because you assume it is unavailable (see the burden of proof below).
| # | Path | Privilege | Notes |
|---|---|---|---|
| 1 | REST / OData — GET first | Narrowest. Scoped service user | Read-only by construction when you stay on GET. $metadata gives you the contract |
| 2 | SOAP / web service | Scoped service user | Typed contract via ?wsdl. Client-cert auth where offered — no password in a script |
| 3 | RFC / BAPI (creds exec, JCo, pyrfc) | RFC user with S_RFC | For ABAP writes, prefer this over 1–2: BAPIs have real commit/rollback semantics and land in SM19/SM20 |
| 4 | OS shell as the correct user → DB utility | ⚠️ Escalates — see below | The chain matters more than the rung |
| 5 | Browser automation (headless or in-app) | Interactive user | Session-based UIs only. Fragile across releases |
| 6 | Computer Use / screen driving | Interactive user | Last resort. Not repeatable, not diffable, breaks on any UI change |
⚠️ Rung 4 is a chain, and each link widens the blast radius
ssh <host> ← host access → su - <sid>adm ← SAP admin: can stop/start the system → su - ora<sid> / syb<sid> ← DB owner: can drop data → sudo / root ← everything → hdbsql | isql | dbmcli | sqlplus | db2 ← the actual commandStop at the least-privileged user that can run the command. Most read-only checks need only
<sid>adm; DB utilities usually need the DB owner; root is almost never the right answer andsaproot.shis the rare legitimate exception. Say which user you used and why.
Two axes, and they do not agree
The ladder ranks by automation quality — repeatable, reviewable, loggable, diffable. Privilege runs on a different axis and is worst in the middle: rung 4 (OS/root) can destroy a system, while rung 6 (Computer Use) is merely an interactive user clicking. So Computer Use ranks last for reproducibility, not because it is the most dangerous.
The practical rule: prefer the highest rung, but never escalate privilege to climb it. A read-only OData call beats an RFC that needs a write-capable user; an
<sid>admshell beats a root shell. If climbing a rung requires more privilege than the task needs, stay where you are and say so.
🛑 You must demonstrate the absence of a programmatic path, not assume it
"There is no API for this" is a finding that requires evidence, not a default. Before dropping to rung 5 or 6, actually probe:
- HTTP status codes tell you the access mode.
401→ Basic auth works, scriptable.302regardless of credentials → session UI, browser needed.404→ not deployed.503→ deployed but stopped.- Look for a contract: append
?wsdl,$metadata,/api,?sap-client=and see what answers.- Ask the platform what it exposes:
sapcontrol -function J2EEGetApplicationAliasList,hdbcons help,btp --help,xs help,<tool> -h.- A Swing or WebDynpro UI being un-automatable does not mean the objects are. The editor and the API are different doors — check for the second before declaring the first is the only one.
Programmatic execution is repeatable, reviewable, loggable and diffable; screen-driving is none of those. When you do drop to a lower rung, say which rung you are on and what you probed to rule out the higher ones — so the user can correct you if they know of a path you missed.
Work that produces evidence (logs, traces, command output, screenshots, reports) has two reasonable endings. Ask which the user wants rather than guessing:
Don't dump large output into the conversation unasked, and don't silently discard evidence either — for troubleshooting and any change with a rollback, (a) is usually the right default to offer.
Identify the right OS user before running anything, and switch with a login shell. Wrong-user
execution is a top cause of SAP failures, and the damage outlives the command: files created by root
under /usr/sap, /sapmnt or a DB directory break every later start by the real owner. A login shell
also matters because each user carries the environment the tools need (SAPSYSTEMNAME, ORACLE_HOME/
ORACLE_SID, SYBASE, DB2INSTANCE, library paths) — without it, commands fail or act on the wrong system.
| What you're operating | UNIX user | Windows |
|---|---|---|
SAP instances — sapcontrol, startsap/stopsap, tp, R3trans, disp+work, sappfpar, cleanipc | <sid>adm (lower-case SAP SID) | <SID>adm; services run as SAPService<SID> |
SAP HANA — HDB, hdbsql, hdbnsutil | <sid>adm of the HANA SID (e.g. h10adm — may differ from the SAP SID) | n/a (HANA server is Linux-only) |
Oracle — sqlplus, lsnrctl, BR*Tools | ora<dbsid> (BR*Tools also runs as <sid>adm; generic installs may use oracle) | <SID>adm; DB runs as a service |
SAP ASE — isql, startserver, Backup Server | syb<dbsid> | syb<dbsid> / SAPService<SID> |
IBM Db2 — db2start/db2stop, db2 CLP | db2<dbsid> (the instance owner = DB2INSTANCE) | same; Db2 runs as a service |
SAP MaxDB / liveCache — dbmcli, x_server | sdb (software owner, group sdba) + a DBM operator at DB level | install/service account |
MS SQL Server — sqlcmd, service control | n/a (Windows-only for SAP) | <SID>adm / the SQL Server service account |
SAP Host Agent — saphostexec, saphostctrl | root | Administrator / SAPHostExec service |
Rules
su - <user> (the - is what loads the environment) or sudo -iu <user>.
Windows: use the correct account, or an elevated shell only where documented.root only where the procedure explicitly says so — e.g. saproot.sh after a kernel extract, SAP Host
Agent install/upgrade. Never as a shortcut around a permission error; that is how root-owned files get
created and break the system later.whoami / id, plus the env actually being set (echo $SAPSYSTEMNAME,
echo $ORACLE_SID, echo $DB2INSTANCE, echo $SYBASE).<sid>adm:"), and if the required user is not
available, say so and stop — do not substitute another user.SAP Notes supersede this file. Landscapes differ by release, patch level, DB and OS, and SAP changes procedures via Notes/KBAs between doc revisions.
If the SAP Notes MCP is configured, use it before acting on anything version-specific — especially any destructive step, or when a command here doesn't behave as documented:
search the topic (e.g. the component + symptom, or a Note number cited below).fetch the promising Note IDs for the current text, validity (affected releases/components),
prerequisites and side effects.attachments array. SAP routinely puts the actual deliverable in an attachment rather
than the Note body — sizing guides, SQL script collections, configuration PDFs, spreadsheets. A Note
whose text says "see the attached document" is not fully read until you have it.Downloading an attachment: fetch returns attachments[].url and attachments[].filename;
fetch_attachment retrieves the bytes. Pass the URL verbatim — the URLs are opaque and cannot be
constructed. If your MCP build predates that tool, open the URL in a signed-in browser instead and say the
file was fetched manually.
⚠️ Two ways a hand-rolled fetch goes wrong — both verified. 1. Trusting the status code. An unauthenticated request returns HTTP 200 with a small HTML login stub, not an error. Check the content type and magic bytes, or you save a JavaScript redirect page under a
…/services/attachment.htm?iv_key=…&iv_guid=…— so the URL basename isattachment.htmeven when the payload is a 24-page PDF. Take the name fromattachments[].filenameor the response'sContent-Dispositionheader, never from the URL path.
No MCP available? Look the Note up on me.sap.com/notes/<id> and say the check was skipped rather than
assuming this file is current.
?tag=compliance-document:compliance-offering/<slug> deep-link
pattern with the slugs listed in the catalogue, and the real scope/SoA wording quoted in §2 (SuccessFactors
ISO 27701 SoA v2.6; ISO 27011 covering IBP + Marketing Cloud + S/4HANA Cloud Public Edition; ISO 22301
covering SAP Ariba Cloud, SAP Business Network, SAP Concur and SAP Fieldglass).
https://www.sap.com/about/trust-center/certification-compliance/compliance-finder.htmlLANGUAGE v.N-YEAR versioning (e.g. SAP Business Technology Platform Service Description Guide —
ENGLISH v.5-2026, SAP Cloud ERP Private; RISE with SAP S/4HANA Cloud, private edition; SAP ERP, private
cloud edition — ENGLISH v.7-2026). https://www.sap.com/about/trust-center/agreements.htmlTo confirm/deepen — this domain changes faster than any other in this repo. Always re-read the Compliance Finder and the Usage Rights page before quoting anything to a customer or auditor; certificate scopes, SoA versions, report consolidations and licence dates all move. For usage rights, also fetch KBA 2878553 via the SAP Notes MCP. And for anything contractual, the answer is the account executive or Customer Success Partner — not this skill.