SAP Cloud Infrastructure Cloud Computing Compliance Criteria Catalog (C5:2020) Audit Report 2024 H1
SAP Converged Cloud
Converged Cloud is SAP’s standardized Infrastructure as a Service (IaaS) offering to support all of SAP’s cloud business on a global scale. SAP Converged Cloud provides access to a vendor-agnostic hardware infrastructure architecture as well as infrastructure orchestration and automation services in all SAP. With SAP Converged Cloud, it is possible to deploy applications into data centers without needing to deploy a solution-specific infrastructure stack (the application infrastructure) beforehand.
The SAP Converged Cloud infrastructure landscape is hosted either in SAP SE owned data centers or co-location data centers, as detailed below:
DC Locations | DC Providers |
United Arab Emirates: Dubai | Co-Location Provider |
Australia: Sydney | Co-Location Provider |
Australia: Sydney | Co-Location Provider |
China: Shanghai | Co-Location Provider |
Japan: Tokyo | Co-Location Provider |
Japan: Osaka | Co-Location Provider |
Saudi Arabia: Riyadh | Co-Location Provider |
Saudi Arabia: Dammam | Co-Location Provider |
Germany: St. Leon-Rot | SAP |
Germany: Walldorf | SAP |
Germany: Frankfurt | Co-Location Provider |
Netherlands: Amsterdam | Co-Location Provider |
Brazil: São Paulo | Co-Location Provider |
Canada: Toronto | Co-Location Provider |
USA: Ashburn, VA | Co-Location Provider |
USA: Newtown Square, PA | SAP |
USA: Sterling, VA | Co-Location Provider |
USA: Colorado Springs, CO | SAP |
USA: Chandler, AZ | Co-Location Provider |
SAP Multi Cloud
The SAP Multi Cloud organization provides a ‘platform of enablement’ for Lines of Business (LoB) in the public cloud, providing costing services such as billing and cost optimization, architecture consultation and application design and security safeguards, tool engineering to automate and expand services offerings and hyperscaler operational support.
The SAP Multi Cloud infrastructure landscape is hosted either in SAP SE owned data centers or co-location data centers, as detailed below:
DC Locations | DC Providers |
USA: N. Virginia | AWS |
USA: NS2 Federal Civilian | AWS |
USA: NS2 DoD | AWS |
Ireland | AWS |
Canada: Central | AWS |
Singapore | AWS |
South Korea: Seoul | AWS |
Japan: Osaka | AWS |
France: Paris | AWS |
Sweden: Stockholm | AWS |
China: Beijing | AWS |
USA: N. California | AWS |
Bahrain | AWS |
UAE | AWS |
Germany: Frankfurt | AWS |
Spain | AWS |
China: Hong Kong | AWS |
Italy: Milan | AWS |
Indonesia: Jakarta | AWS |
Israel: Tel Aviv | AWS |
UK: London | AWS |
India: Mumbai | AWS |
China: Ningxia | AWS |
USA: Ohio | AWS |
Brazil: São Paulo | AWS |
South Africa: Cape Town | AWS |
Australia: Sydney | AWS |
Japan: Tokyo | AWS |
India: Hyderabad | AWS |
USA | AWS |
USA: Oregon | AWS |
Australia: Melbourne | AWS |
Switzerland: Zurich | AWS |
Canada: Montreal | AWS |
Australia: Sydney | AWS |
United Kingdom: London | AWS |
Australia: Sydney | Azure |
Poland: Warsaw | Azure |
USA: California | Azure |
USA: Virginia | Azure |
USA: Iowa | Azure |
USA: Illinois | Azure |
USA: Texas | Azure |
USA: West Central | Azure |
USA: Quincy, WA | Azure |
USA: Virginia | Azure |
USA: DoD East | Azure |
USA: DoD Central | Azure |
Canada: Quebec City | Azure |
Canada: Toronto | Azure |
Brazil: São Paulo | Azure |
USA: Arizona | Azure |
USA: Texas | Azure |
Ireland: Dublin | Azure |
Netherlands: Amsterdam | Azure |
Germany: Magdeburg | Azure |
UK: Cardiff | Azure |
UK: London | Azure |
France: Paris | Azure |
France: Marseille | Azure |
Singapore | Azure |
China: Hong Kong | Azure |
Australia: New South Wales | Azure |
Australia: Victoria | Azure |
China: Shanghai | Azure |
China: Beijing | Azure |
India: Pune | Azure |
India: Mumbai | Azure |
India: Chennai | Azure |
Japan: Tokyo | Azure |
Japan: Osaka | Azure |
South Korea: Seoul | Azure |
South Korea: Busan | Azure |
South Africa: Cape Town | Azure |
South Africa: Johannesburg | Azure |
Australia: Canberra | Azure |
China: Shanghai | Azure |
China: Beijing | Azure |
United Arab Emirates: Abu Dhabi | Azure |
United Arab Emirates: Dubai | Azure |
Germany: North | Azure |
Germany: Frankfurt | Azure |
Switzerland: Zürich | Azure |
Switzerland: Geneva | Azure |
Norway: Oslo | Azure |
Norway: Stavanger | Azure |
Sweden: Staffanstorp | Azure |
Sweden: Gävle | Azure |
Brazil: Rio de Janeiro | Azure |
Qatar: Doha | Azure |
USA: Arizona | Azure |
China: Hebei | Azure |
China: Jiangsu | Azure |
Israel | Azure |
Italy: Milan | Azure |
Israel: Tel Aviv | GCP |
USA: Council Bluffs, IA | GCP |
USA: The Dalles, OR | GCP |
USA: Ashburn, VA | GCP |
USA: Moncks Corner, SC | GCP |
Belgium: St. Ghislain | GCP |
UK: London | GCP |
Singapore: Jurong West | GCP |
Taiwan: Changhua County | GCP |
Japan: Tokyo | GCP |
Australia: Sydney | GCP |
Germany: Frankfurt | GCP |
USA: Los Angeles, CA | GCP |
Canada: Montreal | GCP |
China: Hong Kong | GCP |
India: Mumbai | GCP |
Finland: Hamina | GCP |
Netherlands: Eemshaven | GCP |
Brazil: São Paulo | GCP |
Japan: Osaka | GCP |
Switzerland: Zürich | GCP |
South Korea: Seoul | GCP |
Indonesia: Jakarta | GCP |
USA: Salt Lake City, UT | GCP |
USA: Las Vegas, NV | GCP |
Poland: Warsaw | GCP |
Australia: Melbourne | GCP |
India: Delhi | GCP |
Canada: Toronto | GCP |
Chile: Santiago | GCP |
France: Paris | GCP |
Italy: Milan | GCP |
Spain: Madrid | GCP |
USA: Columbus, OH | GCP |
USA: Dallas, TX | GCP |
Germany: Berlin | GCP |
Qatar: Doha | GCP |
Italy: Turin | GCP |
Cloud Computing Compliance Controls Catalogue (C5) reports are prepared in accordance with attestation standards established by the American Institute of Certified Public Accountants (“AICPA”) and in accordance with the International Standard on Assurance Engagements (“ISAE”) 3000 Revised, Assurance Engamenets Other than Audits or Reviews of Historical Financial Information, issued by the International Auditing and Assurance Board (IAASB). C5 outlines minimum security for cloud computing, aimed at cloud providers, auditors, and clients. Introduced in 2016, it helps customers choose a secure cloud provider and tailor a risk management system. C5 assures cloud services security by providing transparency via a standardized examination and reporting system. The 2020 version of C5 includes 125 criteria from 17 areas, based on national and international standards and publications.
SAP Cloud Infrastructure has prepared C5 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers the audit period 1. April 2023 to 31. March 2024.
The use of these reports is restricted. A copy of this report is available for all SAP customers and prospects with non-disclosure agreement in place.
SAP Converged Cloud
Converged Cloud is SAP’s standardized Infrastructure as a Service (IaaS) offering to support all of SAP’s cloud business on a global scale. SAP Converged Cloud provides access to a vendor-agnostic hardware infrastructure architecture as well as infrastructure orchestration and automation services in all SAP. With SAP Converged Cloud, it is possible to deploy applications into data centers without needing to deploy a solution-specific infrastructure stack (the application infrastructure) beforehand.
The SAP Converged Cloud infrastructure landscape is hosted either in SAP SE owned data centers or co-location data centers, as detailed below:
DC Locations | DC Providers |
United Arab Emirates: Dubai | Co-Location Provider |
Australia: Sydney | Co-Location Provider |
Australia: Sydney | Co-Location Provider |
China: Shanghai | Co-Location Provider |
Japan: Tokyo | Co-Location Provider |
Japan: Osaka | Co-Location Provider |
Saudi Arabia: Riyadh | Co-Location Provider |
Saudi Arabia: Dammam | Co-Location Provider |
Germany: St. Leon-Rot | SAP |
Germany: Walldorf | SAP |
Germany: Frankfurt | Co-Location Provider |
Netherlands: Amsterdam | Co-Location Provider |
Brazil: São Paulo | Co-Location Provider |
Canada: Toronto | Co-Location Provider |
USA: Ashburn, VA | Co-Location Provider |
USA: Newtown Square, PA | SAP |
USA: Sterling, VA | Co-Location Provider |
USA: Colorado Springs, CO | SAP |
USA: Chandler, AZ | Co-Location Provider |
SAP Multi Cloud
The SAP Multi Cloud organization provides a ‘platform of enablement’ for Lines of Business (LoB) in the public cloud, providing costing services such as billing and cost optimization, architecture consultation and application design and security safeguards, tool engineering to automate and expand services offerings and hyperscaler operational support.
The SAP Multi Cloud infrastructure landscape is hosted either in SAP SE owned data centers or co-location data centers, as detailed below:
DC Locations | DC Providers |
USA: N. Virginia | AWS |
USA: NS2 Federal Civilian | AWS |
USA: NS2 DoD | AWS |
Ireland | AWS |
Canada: Central | AWS |
Singapore | AWS |
South Korea: Seoul | AWS |
Japan: Osaka | AWS |
France: Paris | AWS |
Sweden: Stockholm | AWS |
China: Beijing | AWS |
USA: N. California | AWS |
Bahrain | AWS |
UAE | AWS |
Germany: Frankfurt | AWS |
Spain | AWS |
China: Hong Kong | AWS |
Italy: Milan | AWS |
Indonesia: Jakarta | AWS |
Israel: Tel Aviv | AWS |
UK: London | AWS |
India: Mumbai | AWS |
China: Ningxia | AWS |
USA: Ohio | AWS |
Brazil: São Paulo | AWS |
South Africa: Cape Town | AWS |
Australia: Sydney | AWS |
Japan: Tokyo | AWS |
India: Hyderabad | AWS |
USA | AWS |
USA: Oregon | AWS |
Australia: Melbourne | AWS |
Switzerland: Zurich | AWS |
Canada: Montreal | AWS |
Australia: Sydney | AWS |
United Kingdom: London | AWS |
Australia: Sydney | Azure |
Poland: Warsaw | Azure |
USA: California | Azure |
USA: Virginia | Azure |
USA: Iowa | Azure |
USA: Illinois | Azure |
USA: Texas | Azure |
USA: West Central | Azure |
USA: Quincy, WA | Azure |
USA: Virginia | Azure |
USA: DoD East | Azure |
USA: DoD Central | Azure |
Canada: Quebec City | Azure |
Canada: Toronto | Azure |
Brazil: São Paulo | Azure |
USA: Arizona | Azure |
USA: Texas | Azure |
Ireland: Dublin | Azure |
Netherlands: Amsterdam | Azure |
Germany: Magdeburg | Azure |
UK: Cardiff | Azure |
UK: London | Azure |
France: Paris | Azure |
France: Marseille | Azure |
Singapore | Azure |
China: Hong Kong | Azure |
Australia: New South Wales | Azure |
Australia: Victoria | Azure |
China: Shanghai | Azure |
China: Beijing | Azure |
India: Pune | Azure |
India: Mumbai | Azure |
India: Chennai | Azure |
Japan: Tokyo | Azure |
Japan: Osaka | Azure |
South Korea: Seoul | Azure |
South Korea: Busan | Azure |
South Africa: Cape Town | Azure |
South Africa: Johannesburg | Azure |
Australia: Canberra | Azure |
China: Shanghai | Azure |
China: Beijing | Azure |
United Arab Emirates: Abu Dhabi | Azure |
United Arab Emirates: Dubai | Azure |
Germany: North | Azure |
Germany: Frankfurt | Azure |
Switzerland: Zürich | Azure |
Switzerland: Geneva | Azure |
Norway: Oslo | Azure |
Norway: Stavanger | Azure |
Sweden: Staffanstorp | Azure |
Sweden: Gävle | Azure |
Brazil: Rio de Janeiro | Azure |
Qatar: Doha | Azure |
USA: Arizona | Azure |
China: Hebei | Azure |
China: Jiangsu | Azure |
Israel | Azure |
Italy: Milan | Azure |
Israel: Tel Aviv | GCP |
USA: Council Bluffs, IA | GCP |
USA: The Dalles, OR | GCP |
USA: Ashburn, VA | GCP |
USA: Moncks Corner, SC | GCP |
Belgium: St. Ghislain | GCP |
UK: London | GCP |
Singapore: Jurong West | GCP |
Taiwan: Changhua County | GCP |
Japan: Tokyo | GCP |
Australia: Sydney | GCP |
Germany: Frankfurt | GCP |
USA: Los Angeles, CA | GCP |
Canada: Montreal | GCP |
China: Hong Kong | GCP |
India: Mumbai | GCP |
Finland: Hamina | GCP |
Netherlands: Eemshaven | GCP |
Brazil: São Paulo | GCP |
Japan: Osaka | GCP |
Switzerland: Zürich | GCP |
South Korea: Seoul | GCP |
Indonesia: Jakarta | GCP |
USA: Salt Lake City, UT | GCP |
USA: Las Vegas, NV | GCP |
Poland: Warsaw | GCP |
Australia: Melbourne | GCP |
India: Delhi | GCP |
Canada: Toronto | GCP |
Chile: Santiago | GCP |
France: Paris | GCP |
Italy: Milan | GCP |
Spain: Madrid | GCP |
USA: Columbus, OH | GCP |
USA: Dallas, TX | GCP |
Germany: Berlin | GCP |
Qatar: Doha | GCP |
Italy: Turin | GCP |
Cloud Computing Compliance Controls Catalogue (C5) reports are prepared in accordance with attestation standards established by the American Institute of Certified Public Accountants (“AICPA”) and in accordance with the International Standard on Assurance Engagements (“ISAE”) 3000 Revised, Assurance Engamenets Other than Audits or Reviews of Historical Financial Information, issued by the International Auditing and Assurance Board (IAASB). C5 outlines minimum security for cloud computing, aimed at cloud providers, auditors, and clients. Introduced in 2016, it helps customers choose a secure cloud provider and tailor a risk management system. C5 assures cloud services security by providing transparency via a standardized examination and reporting system. The 2020 version of C5 includes 125 criteria from 17 areas, based on national and international standards and publications.
SAP Cloud Infrastructure has prepared C5 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers the audit period 1. April 2023 to 31. March 2024.
The use of these reports is restricted. A copy of this report is available for all SAP customers and prospects with non-disclosure agreement in place.