CONTACT US
[gtranslate]
Search
CONTACT US

The SAP Shared Responsibility Model: Who Secures What in the Cloud Era?

Navigating Cloud Security in SAP Environments

The landscape of enterprise resource planning (ERP) is undergoing a monumental shift, driven by the increasing adoption of cloud technologies. Organizations worldwide are migrating their mission-critical SAP systems from traditional on-premise deployments to dynamic cloud environments. This transition is evident in the rise of solutions like SAP S/4HANA Cloud, the comprehensive offering known as RISE with SAP, and the flexible development capabilities of SAP Business Technology Platform (BTP). This move to the cloud promises agility, scalability, and innovation, but it also fundamentally alters the security paradigm.

The Rise of Cloud-Based SAP

The pervasive adoption of cloud-based SAP solutions, including S/4HANA Cloud, RISE with SAP, and SAP BTP, marks a significant departure from the historical model of managing ERP systems entirely within an organization’s own data center. This migration enables companies to harness the power of cloud computing, offloading infrastructure management and gaining access to cutting-edge features. However, this evolution brings with it a new set of considerations, especially concerning security.

Why Security is More Complex in the Cloud (Beyond Traditional On-Premise)

While the cloud offers undeniable benefits, it introduces a new layer of complexity when it comes to SAP Security. Unlike traditional on-premise setups where the customer bore almost the entire burden of security, cloud environments introduce a distributed model of responsibility. The lines between what the cloud provider secures and what remains the customer’s purview become less distinct. This complexity means that the familiar approach to ERP Security needs a significant update. Understanding who is responsible for what is no longer a niche concern but a foundational element of a secure cloud transformation strategy. The intricacies introduced by multi-cloud architectures and hybrid environments further amplify the challenge, requiring a clear understanding of where security responsibilities lie.

Introducing the Shared Responsibility Model: A Fundamental Concept for Cloud Security

This brings us to the crucial concept of the Shared Responsibility Model. It’s a framework designed to clarify security accountabilities between the cloud service provider (like SAP or a hyperscaler such as AWS, Azure, or GCP) and the customer. For organizations running SAP in the cloud, mastering this model is paramount to avoiding critical security gaps, ensuring compliance, and ultimately protecting their most valuable business data and processes. A comprehensive understanding of the Shared Responsibility Model is the first step in building a robust SAP Cybersecurity posture in the cloud era. It helps define the boundaries of SAP Cloud Security, distinguishing between the security of the cloud and security in the cloud.

What is the SAP Shared Responsibility Model?

The shift to cloud computing, particularly for critical enterprise applications like SAP, necessitates a clear understanding of security obligations. This is precisely where the Shared Responsibility Model comes into play. It’s a foundational concept in cloud security that delineates the division of security tasks between the cloud service provider (in this case, SAP or the underlying hyperscaler) and the customer.

Definition and Core Concept: Differentiating "Security of the Cloud" vs. "Security in the Cloud"

At its heart, the Shared Responsibility Model can be understood by differentiating two key aspects: “Security of the Cloud” and “Security in the Cloud.”

  • Security of the Cloud refers to the responsibilities that SAP (or the hyperscaler they utilize) handles. This typically includes the underlying infrastructure, such as the physical data centers, network infrastructure, hardware, and the base operating system and virtualization layers that support the cloud services. It’s about securing the foundation upon which your SAP applications run.
  • Security in the Cloud refers to the responsibilities that remain with the customer. This encompasses everything from the data you put into the cloud, the configuration of your SAP applications, user access management, custom code, and any integrations you build. Essentially, it’s about how you use and secure the cloud services provided.

This distinction is crucial because while SAP ensures the cloud platform is secure, the customer is responsible for securing their use of that platform.

Why it Matters: Avoiding Critical Security Gaps

Misunderstanding the Shared Responsibility Model is a common pitfall that can lead to significant security vulnerabilities and compliance issues. The dangerous misconception that “the cloud provider handles all security” leaves organizations exposed. When customers assume SAP or a hyperscaler like AWS, Azure, or GCP is solely responsible for all security aspects, they inadvertently create critical gaps in their defense posture. These gaps can be exploited, leading to data breaches, unauthorized access, system downtime, and non-compliance with regulatory requirements. For example, if a customer neglects to properly configure application-level security settings or manage user authorizations, these become prime targets for attackers, regardless of how secure the underlying cloud infrastructure is.

Evolution of the Model: From Traditional Data Centers to Hyperscalers

The concept of shared responsibility has evolved significantly. In traditional on-premise data centers, the customer was responsible for virtually everything: physical security, network, servers, operating systems, applications, and data. With the advent of cloud computing, especially with Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) offerings, much of the underlying infrastructure security shifted to the cloud provider.

Now, with offerings like SAP RISE, where SAP manages more of the solution stack, the exact demarcation points become even more nuanced. However, the fundamental principle remains: a shared obligation. Even when SAP manages certain layers, the customer always retains responsibility for their data, application configurations, and user access. Understanding this evolution is key to adapting security strategies for modern SAP cloud deployments.

Customer vs. Provider: Demarcating Responsibilities in SAP Cloud

A deep dive into the Shared Responsibility Model clarifies the distinct roles SAP and the customer play in maintaining a secure cloud environment. It’s not a blanket assumption of security by either party; rather, it’s a precise demarcation, often visualized as a line in the sand, determining who secures what.


SAP’s Responsibilities (Security of the Cloud)

When it comes to “Security of the Cloud,” SAP takes responsibility for the foundational elements that ensure the availability and integrity of the cloud infrastructure and the underlying services they provide. This typically includes:

Physical Infrastructure (Data Centers, Hardware)

SAP secures the physical facilities where their cloud services are hosted, including servers, storage devices, and networking hardware. This involves environmental controls, physical access security, and infrastructure resilience.

Network Infrastructure (SAP’s Network, Firewalls, Load Balancers)

SAP is responsible for securing their own global network infrastructure, including network devices, firewalls, and load balancers, to protect against network-level attacks and ensure connectivity for their cloud services.

Core Software (SAP’s Base Operating System, Virtualization, Database for the managed service)

For managed cloud services, SAP manages and secures the underlying operating systems, virtualization layers, and the databases that support their cloud offerings. This includes patching, configuration, and monitoring of these core components.

Managed Services

In scenarios like RISE with SAP, where SAP acts as the prime contractor and often manages the technical operations on a hyperscaler (like AWS, Azure, or GCP), SAP assumes responsibility for specific managed layers, such as applying patches to the hyperscaler’s operating system or database, further solidifying the secure cloud transformation.

Customer’s Responsibilities (Security in the Cloud)

While SAP handles the “Security of the Cloud,” the customer retains significant responsibilities for “Security in the Cloud.” This customer domain is where the majority of application-level security, data protection, and user management takes place. These responsibilities are crucial for a robust SAP Cybersecurity posture:

Application Layer: Configuration and Customizations

The customer is responsible for securely configuring their specific SAP applications (e.g., S/4HANA configurations), managing custom development, and ensuring that all application settings align with security best practices.

Identity & Access Management (User Roles, Authorizations, Privileged Access)

This is a critical customer responsibility. It involves defining and managing user roles, ensuring proper authorizations, implementing the principle of least privilege, and securely managing privileged user access within the SAP applications. Effective SAP Identity & Access Management (IAM) is vital, and Onapsis can assist in continuously monitoring and validating these access controls to prevent segregation of duties (SoD) conflicts and critical access risks.

Data Protection: Classification, Encryption (Application-level), Data Loss Prevention

Customers are responsible for classifying their data, implementing application-level encryption, and deploying Data Loss Prevention (DLP) strategies to protect sensitive information stored and processed within their SAP systems.

Network Controls: Customer-managed VPNs, Virtual Private Cloud (VPC) configurations

While SAP secures its own network, customers are responsible for securing their connectivity to SAP cloud services. This includes configuring customer-managed VPNs, securing their Virtual Private Cloud (VPC) or Virtual Network (VNet) settings, and managing network access controls to their SAP instances.

Integrations: Third-Party Connections and APIs

Any integrations with third-party systems or the use of APIs (Application Programming Interfaces) fall squarely within the customer’s security responsibility. This requires careful assessment of the security of connected systems and securing data flows between them. Onapsis extends visibility and threat detection to these critical integration points.

Custom Code and Development

Any custom code developed by the customer or third parties for their SAP applications must adhere to secure coding practices. Incorporating SAP DevSecOps principles ensures security is built into the development lifecycle from the start, a process Onapsis supports by integrating security into the CI/CD pipeline for custom SAP developments.

Security Monitoring and Incident Response (Application and Data Layers)

While SAP monitors its infrastructure, customers are responsible for monitoring their SAP application layer for suspicious activities, security anomalies, and potential threats. This includes setting up robust SAP security monitoring and having an incident response plan for application-level security events, often leveraging solutions for enterprise threat detection provided by Onapsis to gain real-time insights into attacks and vulnerabilities impacting SAP applications.

Compliance and Governance Validation

The ultimate responsibility for demonstrating compliance with industry regulations (like GDPR, SOX, NIST) and internal governance policies for the SAP applications and data rests with the customer. This often involves processes for SAP Automated Compliance, a key area where Onapsis excels by automating control testing and audit readiness.

Shared Responsibility in Key SAP Cloud Environments

The Shared Responsibility Model isn’t a one-size-fits-all concept. Its specific application can vary depending on the particular SAP cloud offering your organization utilizes. Understanding these nuances is crucial for pinpointing your exact security obligations.

RISE with SAP and the Shared Model

RISE with SAP represents a significant shift in how enterprises consume SAP. It’s a bundled offering that often includes S/4HANA Cloud, technical managed services, and access to the SAP Business Technology Platform. While RISE aims to simplify the cloud journey, it’s vital to clarify security roles.

Clarifying Roles in RISE with SAP

Under RISE with SAP, SAP often takes on more operational responsibility, managing the underlying infrastructure, operating systems, and database layers on a chosen hyperscaler. However, this increased management by SAP does not absolve the customer of their security duties.

Specific Customer Responsibilities

Even with SAP managing significant portions of the stack, the customer remains responsible for securing the application layer of their S/4HANA instance. This includes critical tasks such as:

  • Properly configuring S/4HANA applications
  • Managing user access, roles, and authorizations
  • Securing custom developments and integrations
  • Protecting data within the S/4HANA application
  • Monitoring for application-level threats and vulnerabilities

Leveraging Tools for RISE Security

Given these persistent customer responsibilities, organizations adopting RISE with SAP need robust solutions to gain visibility and control over their portion of the shared model. This is where a platform like Onapsis becomes invaluable. Onapsis specifically helps customers secure their configurations, manage vulnerabilities, detect threats at the application layer, and ensure compliance within their S/4HANA and SAP RISE security landscapes, effectively closing the visibility and control gaps left by the shared model. Onapsis has strong authority and dedicated offerings in this space.

SAP Business Technology Platform (BTP) Security

SAP Business Technology Platform (BTP) offers a Platform-as-a-Service (PaaS) environment for extending and integrating SAP applications, as well as building new ones. The shared responsibility model here shifts slightly due to the PaaS nature.

PaaS-Specific Responsibilities

In BTP, SAP secures the underlying platform, including the runtime environment, database services, and connectivity services. However, the customer is fully responsible for:


Data and User Access in BTP Applications


Customers are entirely responsible for the data they store and process within their BTP applications. This includes data encryption, classification, and access control. Similarly, managing user access to custom BTP applications and their underlying data remains a customer responsibility, emphasizing the need for stringent SAP Identity & Access Management (IAM) practices.

SAP S/4HANA Cloud (Public vs. Private Editions)

The shared responsibility also has nuances between the public and private editions of SAP S/4HANA Cloud.

  • Nuances in Responsibility based on Deployment Model

    The specific allocation of responsibilities between SAP and the customer depends significantly on the deployment model chosen, directly impacting the level of control and, consequently, the security tasks that fall to the customer.

  • S/4HANA Cloud (Public Edition):

    This is a highly standardized, multi-tenant SaaS offering. SAP manages more of the stack, and customer customization is limited. Consequently, SAP’s share of security responsibility is greater. The customer’s focus is primarily on user access, data within the application, and integration security.

  • S/4HANA Cloud (Private Edition):

    This offering provides more flexibility and control, often running on a hyperscaler within a customer’s dedicated environment. While SAP still manages the core application, the customer has more responsibility for network configurations, integrations, and deeper application-level security settings. This model more closely resembles the responsibilities seen in RISE with SAP.

  • Focus on Application-Level Security

    Regardless of the S/4HANA Cloud edition, the customer’s primary security focus remains on the application layer. This includes configurations, user management, custom code, and data protection. Tools that provide deep visibility and control over the SAP application layer are essential for mitigating risks, particularly those related to transformation with S/4HANA.

Common Misconceptions and Their Consequences

Despite the clear definitions of the Shared Responsibility Model, several persistent misconceptions continue to exist. These misunderstandings are https://onapsis.com/solutions/; they often lead to critical security gaps and severe consequences for organizations.

"SAP handles all the security." (Why this is false and dangerous)

Perhaps the most pervasive and dangerous misconception is the belief that once an organization moves its SAP systems to the cloud, the cloud provider, whether SAP directly or a hyperscaler, assumes full responsibility for all security. This could not be further from the truth. While SAP secures the underlying infrastructure and services (security of the cloud), the customer is always responsible for securing their data, configurations, access controls, and custom developments (security in the cloud). Operating under the false assumption that “SAP handles all the security” creates a false sense of security, leaving vast areas of the customer’s cloud SAP landscape vulnerable.

Impact of Misunderstanding: Data Breaches, Compliance Failures, Operational Disruptions

The consequences of misunderstanding and failing to properly operationalize the Shared Responsibility Model can be severe and far-reaching:

  • Data Breaches: Incorrect configurations, weak access controls, or unpatched application vulnerabilities on the customer’s side can directly lead to unauthorized access to sensitive business data, resulting in costly and reputation-damaging data breaches.

  • Compliance Failures: Organizations operate under various regulatory frameworks (e.g., GDPR, SOX, NIST, HIPAA). A failure to secure the customer’s portion of the SAP cloud environment can lead to non-compliance, hefty fines, legal repercussions, and damage to customer trust. Demonstrating SAP Automated Compliance requires active customer engagement.

  • Operational Disruptions: Security incidents stemming from mismanaged customer responsibilities, such as unpatched critical vulnerabilities or successful ransomware attacks targeting the SAP application layer, can lead to significant operational downtime, impacting core business processes like supply chain, finance, and human resources.
  • Financial Loss: Beyond fines and recovery costs, security incidents can incur significant financial losses due to intellectual property theft, fraud, and prolonged business interruption.

Real-World Examples of Gaps

While specific customer incidents are rarely made public, general patterns highlight the impact of shared responsibility gaps:

  • Misconfigured S/4HANA Systems: Many incidents stem from basic misconfigurations within the SAP application layer that could have been prevented with proper hardening and continuous monitoring, areas where the customer holds the primary responsibility.

  • Privilege Escalation through Weak Access Controls: Exploitation of overly permissive user roles or unmonitored privileged access accounts within the SAP application environment demonstrates a clear failure in the customer’s SAP Identity & Access Management (IAM) responsibilities.

  • Exploitation of Unpatched Application Vulnerabilities: Despite SAP releasing security notes (like on SAP Patch Day), if customers fail to apply these patches to their application layer in a timely manner, they remain exposed to known exploits. This highlights the customer’s critical role in SAP Vulnerability Management.
These examples underscore that even with the most secure cloud infrastructure provided by SAP, the customer’s active role in securing their part of the model is non-negotiable for true enterprise security.

Best Practices for Securing Cloud ERP Under Shared Responsibility

Navigating the SAP Shared Responsibility Model effectively requires a proactive and strategic approach from the customer’s side. Implementing a comprehensive security strategy that specifically addresses the “security in the cloud” aspect is paramount. Here are key best practices:

Comprehensive Visibility: Gaining Unified Oversight Across Cloud & Hybrid SAP

One of the foundational challenges in the cloud era is the loss of complete visibility that organizations once had with entirely on-premise systems. To mitigate this, establishing comprehensive visibility across all your SAP landscapes, whether fully cloud-based or in hybrid environments, is crucial. This means having tools and processes that provide a unified view of security posture, configurations, vulnerabilities, and threats at the SAP application layer, complementing the visibility provided by hyperscalers for infrastructure.

Proactive Configuration Management: Preventing Misconfigurations at Scale

Misconfigurations are a leading cause of cloud security breaches. For SAP systems, this can include incorrectly set user permissions, exposed interfaces, or insecure system parameters. Implementing proactive configuration management involves:

  • Establishing secure baseline configurations for all SAP cloud instances.
  • Continuously monitoring configurations for deviations from these baselines.
  • Automating the identification and remediation of misconfigurations at scale.

Robust Identity & Access Governance: Implementing Least Privilege, MFA, RBAC

Identity and Access Management (IAM) is arguably the customer’s most critical security responsibility in the cloud. Best practices include:

  • Implementing the Principle of Least Privilege: Users and applications should only have the minimum access necessary to perform their functions.
  • Multi-Factor Authentication (MFA): Enforcing MFA for all SAP users, especially privileged accounts, adds a crucial layer of security against credential theft.

Role-Based Access Control (RBAC): Defining clear roles and assigning permissions based on these roles streamlines management and reduces the risk of excessive access. This is fundamental for SAP Identity & Access Management (IAM).

Continuous Threat Detection & Monitoring: Real-time Alerts for Anomalies

Relying solely on infrastructure-level monitoring from cloud providers is insufficient for SAP applications. Customers need capabilities for continuous SAP security monitoring that can:

  • Detect malicious activity, suspicious user behavior, and anomalies within the SAP application layer in real-time.
  • Analyze SAP logs and system events for indicators of compromise.
  • Integrate with broader Security Information and Event Management (SIEM) systems for a holistic view of enterprise security. Such capabilities are essential for effective enterprise threat detection.

Vulnerability & Patch Management: Ensuring Application-Layer Security Notes are Applied

Relying solely on infrastructure-level monitoring from cloud providers is insufficient for SAP applications. Customers need capabilities for continuous SAP security monitoring that can:

  • Detect malicious activity, suspicious user behavior, and anomalies within the SAP application layer in real-time.
  • Analyze SAP logs and system events for indicators of compromise.
  • Integrate with broader Security Information and Event Management (SIEM) systems for a holistic view of enterprise security. Such capabilities are essential for effective enterprise threat detection.

Secure Integrations: Assessing Third-Party Risks

Modern SAP environments are rarely standalone; they integrate with numerous third-party applications and services. Customers must:

  • Thoroughly vet the security posture of all integrated third-party solutions.
  • Secure communication channels and APIs used for integrations.
  • Continuously monitor data flows and access permissions for integrated systems.

Automated Compliance Validation: Bridging the Gap from Policy to Practice

Maintaining continuous compliance with internal policies and external regulations (like SOX, GDPR, NIST for SAP compliance) is a significant customer responsibility. Manual compliance checks are often insufficient and error-prone in dynamic cloud environments. Implementing SAP Automated Compliance solutions can:

  • Automate control testing and evidence collection.
  • Provide real-time visibility into compliance posture.
  • Streamline audit readiness and reporting.

Security by Design: Integrating Security into DevOps/DevSecOps for SAP

For custom developments and extensions within SAP cloud environments (e.g., SAP BTP), embedding security early in the development lifecycle is crucial. SAP DevSecOps principles ensure that security considerations are integrated from the design phase through development, testing, and deployment, reducing vulnerabilities before they reach production.

How Onapsis Helps Operationalize the Shared Responsibility Model

While SAP and hyperscalers secure the cloud infrastructure, the onus remains on the customer to secure their business-critical applications and data in the cloud. This is precisely where solutions designed for enterprise application security become indispensable. Onapsis plays a pivotal role in empowering organizations to effectively operationalize their portion of the Shared Responsibility Model for SAP environments, providing the necessary visibility, automation, and threat intelligence.

Closing the Visibility Gap for Customer-Owned Layers

One of the biggest challenges for customers in cloud and hybrid SAP environments is gaining comprehensive visibility into their application layer. Traditional security tools often lack the deep understanding of SAP’s unique architecture. Onapsis provides unparalleled visibility into the configurations, vulnerabilities, and user access within SAP applications, whether they are running on-premise, in a hyperscaler, or as part of RISE with SAP. This unified oversight allows customers to understand their true attack surface and potential risks within their responsibility domain.

Automating Vulnerability Management & Configuration Hardening

Manual processes for identifying and remediating SAP vulnerabilities and misconfigurations are unsustainable at scale, especially in dynamic cloud environments. Onapsis automates SAP vulnerability management by continuously scanning for missing patches (including those highlighted on SAP Patch Day), insecure configurations, and custom code vulnerabilities. It provides actionable intelligence to help prioritize and remediate these findings, significantly reducing the customer’s exposure to known exploits and strengthening their overall posture. This includes proactive configuration management to prevent misconfigurations at scale.

Ensuring Continuous Compliance & Audit Readiness

Meeting regulatory requirements and internal governance policies for SAP systems is a continuous customer responsibility. Onapsis helps bridge the gap from policy to practice by facilitating SAP Automated Compliance. It provides automated control testing, continuous monitoring against compliance benchmarks (like SOX, GDPR, NIST), and simplified audit evidence collection. This ensures organizations are continuously audit-ready, reducing the burden of manual compliance checks and minimizing the risk of non-compliance fines.

Real-Time Threat Detection & Response for SAP Applications

Even with robust preventive measures, the threat landscape is constantly evolving. Customers need the capability to detect and respond to active threats targeting their SAP applications. Onapsis provides specialized SAP security monitoring and enterprise threat detection capabilities that go beyond network and endpoint security. It monitors SAP application logs and activities in real-time, identifying anomalous behavior, indicators of compromise, and active attacks, enabling rapid incident response and minimizing potential damage.

Support for Specific Cloud Offerings

Onapsis understands the nuances of different SAP cloud deployments. It offers tailored support and capabilities for securing various cloud offerings, including:

  • RISE with SAP: Providing the deep application-layer security necessary to complement SAP’s responsibilities, giving customers control over their SAP RISE security.
  • SAP Business Technology Platform (BTP): Helping secure custom applications and developments on the PaaS layer, integrating security into the SAP DevSecOps pipeline.
  • SAP S/4HANA Cloud: Delivering critical insights into application configurations and vulnerabilities, essential for effective transformation with S/4HANA and ongoing security in both public and private editions.

By partnering with Onapsis, organizations can confidently embrace cloud-based SAP, knowing they have a robust solution to fulfill their security responsibilities within the Shared Responsibility Model.

Conclusion: Taking Ownership of Your SAP Cloud Security Posture

The journey to the cloud for SAP systems brings undeniable benefits in terms of agility and innovation, but it fundamentally redefines the security landscape. The SAP Shared Responsibility Model is not merely a theoretical concept; it’s a critical operational framework that demands active engagement from every organization.

Recap of Key Takeaways: Shared Responsibility is Non-Negotiable

As we’ve explored, the distinction between “security of the cloud” (the provider’s domain) and “security in the cloud” (the customer’s domain) is the cornerstone of understanding modern SAP security. Misconceptions about this model can lead directly to significant security vulnerabilities, impacting data integrity, system availability, and regulatory compliance. Whether you’re running on SAP S/4HANA Cloud, utilizing RISE with SAP, or building on SAP BTP, your organization retains substantial security responsibilities, particularly at the application, data, and access layers.

The Importance of a Proactive and Strategic Approach

Effective cloud SAP security requires a shift from a reactive stance to a proactive and strategic one. This means:

  • Embracing comprehensive visibility into your entire SAP landscape.
  • Implementing robust identity and access governance.
  • Continuously managing vulnerabilities and configurations.
  • Establishing real-time threat detection and response capabilities for your critical SAP applications.
  • Integrating security practices early into your development cycles, following SAP DevSecOps principles.
  • Automating compliance validation to ensure continuous audit readiness.

Ignoring these customer-side responsibilities is akin to leaving the front door unlocked, even if the house itself is sturdy.

Future Outlook: Evolving Cloud Landscape and Security Challenges

The cloud landscape for SAP will continue to evolve, with new services, deployment models, and integration patterns emerging. As organizations increasingly rely on their cloud ERP systems, the sophistication of threats targeting these environments will also grow. This necessitates continuous vigilance and an adaptive security strategy. Remaining educated on evolving best practices, leveraging specialized SAP security products, and partnering with experts who understand the unique intricacies of SAP application security in the cloud will be vital for maintaining a strong security posture in the face of future challenges. Ultimately, taking full ownership of your organization’s responsibilities within the SAP Shared Responsibility Model is the only path to truly secure cloud transformation.

Frequently Asked Questions (FAQs) about SAP Cloud Security

What is the core principle of the SAP Shared Responsibility Model?

The core principle is that security is a shared obligation between SAP (or the cloud provider) and the customer. SAP is responsible for the “security of the cloud,” meaning the underlying infrastructure and services. The customer is responsible for the “security in the cloud,” which includes their data, application configurations, access management, and custom developments.

Why can’t SAP or my cloud provider secure everything for me?

While cloud providers offer a highly secure infrastructure, they do not have access to or control over your specific data, application configurations, user setups, or custom code. These elements are unique to your business operations, and securing them requires your active management and vigilance.

What are common customer responsibilities in SAP cloud security?

Key customer responsibilities include managing user identities and access, securing application configurations, protecting sensitive data, ensuring the security of custom code, managing integrations, and performing application-level security monitoring and incident response.

How does the Shared Responsibility Model apply to RISE with SAP?

With RISE with SAP, SAP typically manages more of the technical operations and underlying infrastructure. However, the customer retains responsibility for application configurations, user access, data protection, and any custom code or integrations within their S/4HANA instance. This makes SAP RISE security a collaborative effort.

Is SAP S/4HANA Cloud (Public Edition) more secure from a customer’s perspective?

In S/4HANA Cloud (Public Edition), SAP manages a larger portion of the stack due to its standardized SaaS nature. This can reduce the customer’s operational burden for certain security aspects. However, the customer still holds responsibility for user access, data management within the application, and securing specific configurations and integrations.

What role does Onapsis play in helping customers with the Shared Responsibility Model?

Onapsis helps customers operationalize their share of the security responsibility by providing deep visibility into SAP applications, automating SAP vulnerability management and configuration hardening, enabling continuous SAP security monitoring for threats, and assisting with SAP Automated Compliance validation across various cloud deployments.

What are the risks of misunderstanding the Shared Responsibility Model?

Misunderstanding can lead to critical security gaps, resulting in potential data breaches, non-compliance with regulatory requirements, operational disruptions, and significant financial losses. It often stems from the false assumption that the cloud provider handles all security.

How can organizations ensure robust access control in their cloud SAP systems?

Implementing strong SAP Identity & Access Management (IAM) practices is crucial. This includes enforcing the principle of least privilege, utilizing Multi-Factor Authentication (MFA), establishing Role-Based Access Control (RBAC), and regularly reviewing user authorizations to prevent unauthorized access.

Are SAP security products different for cloud environments compared to on-premise?

While the fundamental security principles remain, the specific tools and approaches may differ. Cloud environments often require solutions that can integrate with hyperscaler services, provide API security, and offer continuous monitoring capabilities tailored to dynamic cloud infrastructures, extending beyond traditional on-premise tooling.

How important is SAP DevSecOps in cloud SAP environments?

SAP DevSecOps is highly important for cloud SAP, especially when developing custom applications or extensions on platforms like SAP BTP. Integrating security practices early into the development lifecycle helps identify and remediate vulnerabilities before they reach production, ensuring security by design.

Does the shared responsibility model impact ERP for utilities or other specific industries?

Yes, the Shared Responsibility Model applies universally across all industries using cloud ERP. For sectors like utilities, which often face unique regulatory and operational technology (OT) security requirements, understanding and fulfilling the customer’s security responsibilities is even more critical to meet sector-specific compliance and protect vital infrastructure.

How can organizations prepare for SAP Patch Day in a cloud environment?

Customers must have a robust process for tracking SAP security notes released on SAP Patch Day, assessing their relevance to their cloud environment, prioritizing critical patches, and efficiently applying them to their SAP applications. Automated tools can greatly assist in this ongoing SAP Vulnerability Management process.

Take Action: Secure Your SAP Environment with Onapsis

Schedule a Demo

to see how Onapsis can streamline your SAP patching strategy

Get started

Contact Us

to discuss how Onapsis solutions can enhance your SAP security posture

Start a conversation

Sitemap  | Terms of Use | Privacy Policy   |  Quality Policy  |  Disclosure Policy |  Security Vulnerability Reporting Guidelines |  ©2025 Onapsis  |  All rights reserved