DORA Mapping
The table below represents SAP’s contractual provisions when compared to the Digital Operational Resilience Act (DORA), Article 30 Key Contractual Provisions. SAP is currently reviewing and enhancing our processes to meet the requirements under DORA so we can offer you an agreement meeting the expectations of most EU financial entities. Download the Document
The table below represents SAP’s contractual provisions when compared to the Digital Operational Resilience Act (DORA), Article 30 Key Contractual Provisions. SAP is currently reviewing and enhancing our processes to meet the requirements under DORA so we can offer you an agreement meeting the expectations of most EU financial entities. PUBLIC
DORA Mapping of the SAP Agreement
For Financial Entities
Version August 2024
DORA Project Team
DORA Mapping of the SAP Agreement
For Financial Entities
Version August 2024
DORA Project Team
© 2024 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 3 / 15
The table below represents SAP’s contractual provisions when compared to the Digital Operational Resilience Act (DORA), Article 30 Key
Contractual Provisions. We are currently reviewing and enhancing our processes to meet the requirements under DORA so we can offer you
an agreement meeting the expectations of most EU financial entities. We will provide you with a status of such agreement on or about the
end of Q4 2024.
This document is for informational purposes, only, and although reliable, should not be the sole basis of making a purchasing decision. It
does not provide legal or professional advice, and SAP may modify any information expressed in this DORA Map as regulatory and security
requirements evolve. Customers are encouraged to seek independent counsel and guidance on these laws in support of their compliance
efforts.
For more information on SAP’s compliance efforts, please reference our NIS2 DORA FAQ (Frequently Asked Questions). For additional
questions, you can reach out to your sales representative.
The table below represents SAP’s contractual provisions when compared to the Digital Operational Resilience Act (DORA), Article 30 Key
Contractual Provisions. We are currently reviewing and enhancing our processes to meet the requirements under DORA so we can offer you
an agreement meeting the expectations of most EU financial entities. We will provide you with a status of such agreement on or about the
end of Q4 2024.
This document is for informational purposes, only, and although reliable, should not be the sole basis of making a purchasing decision. It
does not provide legal or professional advice, and SAP may modify any information expressed in this DORA Map as regulatory and security
requirements evolve. Customers are encouraged to seek independent counsel and guidance on these laws in support of their compliance
efforts.
For more information on SAP’s compliance efforts, please reference our NIS2 DORA FAQ (Frequently Asked Questions). For additional
questions, you can reach out to your sales representative.
© 2024 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 4 / 15
DORA Article 30 Supporting Information Provisions Found in the FSA Provisions found in the Cloud Services
Agreement
1. The rights and obligations of the
financial entity and of the ICT third-
party service provider shall be
clearly allocated and set out in
writing. The full contract shall
include the service level agreements
and be documented in one written
document which shall be available
to the parties on paper, or in a
document with another
downloadable, durable and
accessible format.
SAP agreements for the Cloud Service consists of the
following components, list in the final column.
Copies of the Agreement are publicly available for
download at the Trust Center Agreements Website.
For financial entities subject to financial services
outsourcing regulatory requirements, SAP offers an
annex titled, "SAP Annex for Regulatory
Requirements" or what we call the FSA. The FSA
contains many requirements found under the EBA
Outsourcing Guidelines. The FSA supplements the
security provisions outlined in the Agreement, and
when the FSA is referenced and incorporated in the
Agreement, form one written document and can be
made available as one downloadable, durable, and
easily accessible document.
SAP is currently updating the FSA according to the
DORA and RTS requirements and will make the new
version available to its customers in the coming
months. We will notify you upon its availability.
Contains many provisions of the EBA
Outsourcing Guidelines, which are
analogous to the provisions found
under DORA, Article 30.
SAP agreements for the Cloud Service
consists of the following components, in its
order of precedence (Agreement):
1. SAP Cloud Order Form including Schedule
1 (Order Form).
2. Supplemental Terms and Conditions for
Cloud Services (Supplement).
3. Support Schedule for Cloud Services
(Support).
4. Service Level Agreement for Cloud
Services (SLA).
5. Data Processing Agreement for Cloud
Services (DPA).
6. General Terms and Conditions for Cloud
Services (GTC).
Service Specifications for select Cloud
Services like Ariba, and Grow with SAP
S/4HANA Cloud Services
DORA Article 30 Supporting Information Provisions Found in the FSA Provisions found in the Cloud Services
Agreement
1. The rights and obligations of the
financial entity and of the ICT third-
party service provider shall be
clearly allocated and set out in
writing. The full contract shall
include the service level agreements
and be documented in one written
document which shall be available
to the parties on paper, or in a
document with another
downloadable, durable and
accessible format.
SAP agreements for the Cloud Service consists of the
following components, list in the final column.
Copies of the Agreement are publicly available for
download at the Trust Center Agreements Website.
For financial entities subject to financial services
outsourcing regulatory requirements, SAP offers an
annex titled, "SAP Annex for Regulatory
Requirements" or what we call the FSA. The FSA
contains many requirements found under the EBA
Outsourcing Guidelines. The FSA supplements the
security provisions outlined in the Agreement, and
when the FSA is referenced and incorporated in the
Agreement, form one written document and can be
made available as one downloadable, durable, and
easily accessible document.
SAP is currently updating the FSA according to the
DORA and RTS requirements and will make the new
version available to its customers in the coming
months. We will notify you upon its availability.
Contains many provisions of the EBA
Outsourcing Guidelines, which are
analogous to the provisions found
under DORA, Article 30.
SAP agreements for the Cloud Service
consists of the following components, in its
order of precedence (Agreement):
1. SAP Cloud Order Form including Schedule
1 (Order Form).
2. Supplemental Terms and Conditions for
Cloud Services (Supplement).
3. Support Schedule for Cloud Services
(Support).
4. Service Level Agreement for Cloud
Services (SLA).
5. Data Processing Agreement for Cloud
Services (DPA).
6. General Terms and Conditions for Cloud
Services (GTC).
Service Specifications for select Cloud
Services like Ariba, and Grow with SAP
S/4HANA Cloud Services