Compliance offerings from SAP
How our compliance offerings support our customers’ business needs
SAP is committed to prioritizing compliance through precise standards and practices that guarantee data integrity, regulatory adherence, and ethical conduct across all of our customers’ operations. Explore how to gain insights into these critical areas.
Compliance Documents on Demand
The SAP for Me customer portal is the central access point and the go-to destination for existing SAP customers to download eligible compliance documents on demand. The feature is available in the Portfolio & Products section of SAP for Me.
SAP Central Cloud Services Reports
SAP will release new SOC1, SOC2 and C5 reports as “SAP Central Cloud Services”. These reports replace the former “SAP Business Technology Platform”, “SAP Cloud Infrastructure”, and “SAP Cell and Gene Therapy Orchestration and SAP Intelligent Clinical Supply Management” (only SOC1) reports.
ISO/IEC 42001 for AI management systems
SAP has achieved certification for ISO/IEC 42001, the first global standard for AI management systems. This reflects our implementation of a structured, independently audited AI management system.
DORA Updates
With the applicability of the Digital Operational Resilience Act (DORA) EU regulation since January 2025, SAP is addressing its implications for our customers, partners, and vendors globally. Please review information useful to your company’s compliance efforts.
SAP compliance offerings: Explore certificates, reports, and attestations
At SAP, we keep our finger on the pulse of ever-increasing security challenges by building a security foundation based on industry standards, compliance, and regulatory requirements. View our latest security compliance offerings and reports.
ISO/IEC 42001 AI Management System
Sets audited requirements for responsible AI governance across policies, risk management, deployment, monitoring, and continuous improvement. Supports transparency, human oversight, security, and privacy, and helps customers with regulatory needs.
ISO 9001 Quality Management System
Based on quality management principles including strong customer focus and involving top SAP management with the ultimate goal of continuous improvement.
ISO/IEC 27001 Security Management System
Provides a holistic, risked-based approach to security and a comprehensive and measurable set of information security management practices.
ISO 22301 Business Continuity Management System
Protects business operations from severe disruption, such as extreme weather, fire, natural disaster, theft, IT outage, and more.
BS 10012 Personal Information Management System
Includes employee security awareness training, risk assessments, data retention, and disposal.
ISO/IEC 27018 Code of Practice for Personally Identifiable information
Guidance for cloud service providers to protect personally identifiable information (PII). Supports ISO/IEC 27001 by recommending information security controls for protecting personal data in the public cloud.
ISO/IEC 27017 Code of Practice for Cloud Service Information Security
Codes of practice for information security controls for cloud services. Supports ISO/IEC 27001 by providing guidance on cloud-specific information security controls.
SOC 1 reports
Auditors of SAP's customer financial statements receive information from SAP about controls for cloud solutions that are often relevant to a customer’s internal control over financial reporting. This SOC 1 report follows the SSAE 18 and ISAE 3402 standards for auditing engagements and includes a detailed description of the design (type I/type II) and effectiveness (type II) of the audited controls.
SOC 2 reports
Customers and potential customers gain insights into the control system relevant to security, availability, processing integrity, confidentiality, or privacy of data. The SOC 2 report follows the ISAE 3000 and AT 101 auditing standards and is based on AICPA’s trust service principles. Includes a detailed description of the design (type I/type II) and effectiveness (type II) of the audited controls.
Bridge letters
Bridge letters are intended to cover the gap between the end date of the referenced report and the issue date of the bridge letter. Bridge letters provide customers with information as to whether there have been any significant changes to their controls environment that could adversely impact the conclusions reached in the most recently completed SOC examination.
Payment Card Industry Data Security Standard (PCI DSS)
This global data security standard, also known as PCI DSS, is adopted by the payment card brands for all entities that process, store, or transmit cardholder data. Comprised of steps that mirror security best practices across the industry.
Good Practice Quality Guidelines and Regulations (GxP)
GxP is a collection of quality guidelines and regulations created to ensure that biopharmaceutical products are safe, meet their intended use, and adhere to quality processes during manufacturing, control, storage, and distribution.
Trusted Information Security Assessment Exchange (TISAX)
TISAX enables mutual acceptance of Information Security Assessments in the automotive industry and provides a common assessment and exchange protocol.
The following SAP SE locations are evaluated at TISAX AL3 (High Protection Needs) level with zero non-conformities to the assessed control areas. Walldorf (Germany), Bengaluru (India), Bucuresti (Romania), Chicago (USA), Colorado Springs (USA), Newton Square (USA), Chicago (USA), St. Leon-Rot (Germany), San Pedro Garza Garcia (Mexico), and Palo Alto (USA).
Scope ID: S0R94X
Assessment IDs: AMFL1Y-1, AMFL1Y-2
Network & Information Directives (NIS2)
NIS2 is the most recent EU directive aimed and harmonizing and improving its cybersecurity framework for Critical Infrastructure (CI) providers. In addition to SAP being a registered CI provider, SAP serves Critical Infrastructure (CI) providers in many countries across the globe and contributes to their compliance with their respective cybersecurity regulations. SAP is a registered CI provider in Germany (KRITIS), subject to German jurisdiction. We are monitoring Germany’s adoption of its draft NIS2 law and will provide further updates as matters evolve.
The Digital Operational Resilience Act (DORA)
DORA is an EU regulation on cybersecurity applicable as of January 17, 2025. It aims to strengthen the security and resiliency of information and communication technology (ICT) services of financial entities such as banks, insurance companies, and investment firms, helping to maintain and restore financial functions in the event of a severe operational disruption. DORA brings harmonization of various cybersecurity legal requirements to 20 different types of financial entities and to ICT third-party service providers. Aligning with and building upon NIS2 requirements, DORA takes precedence when it involves financial entities (lex specialis).
Canadian Centre for Cyber Security Cloud Compliance
The Government of Canada Cloud Service Provider Security Assessment Process provides a means for cloud service providers to undergo standardized assessments that inform risk owners responsible for Security Assessment and Authorization. SAP Cloud Services have been assessed against the Protected B/Medium/Medium control profile (Cloud Medium).
Cloud Computing Compliance Controls Catalogue (C5)
C5 has proven itself, because of its neutrality, scope, compactness, and testability, as an attestation for a stable foundation for internal auditing and for information security management in regulated industries.
Cloud Security Assessment (IRAP-CSA)
The Australian Government Cloud Security Assessment and Authorization Framework defines a means for an organization’s cybersecurity team, cloud architects, and business representatives to jointly perform a risk assessment and use SAP Cloud Services securely.
Cybersecurity Classified Protection Scheme (CCPS)
CCPS is a China regional regulatory security certification mandated by article 21 of the China Cybersecurity Law (CCSL) aiming to ensure cybersecurity. It is a China nationwide security program that provides a standardized approach to security design, assessment, audit, certification, renew and continuous monitoring against the CCPS baseline security requirements for systems/networks hosted in Mainland of China. Every organization who owns/operates/runs systems/networks in Mainland of China has CCPS compliance legal obligation.
EU Cloud Code of Conduct (EU Cloud CoC)
Endorsed by the European Data Protection Board and approved by the Belgian Data Protection Authority, the EU Cloud CoC allows cloud service providers to demonstrate adherence to GDPR requirements (Article 28 GDPR and its related Articles).
The EU Data Act
The Data Act (effective September 12, 2025) is designed to enhance the EU’s data economy and foster a competitive data market by making data more accessible and usable, encouraging data-driven innovation and increasing data availability. Applicable in the 27 member states of the European Union, the law offers cloud customers (for data processing services) the right to switch providers within a defined notice period.
Federal Risk and Authorization Management Program (FedRAMP)
For government agencies, security is at the heart of every IT project. Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.
Information System Security Management and Assessment Program (ISMAP)
ISMAP is Japan’s information system security management and assessment program that enables governments to assess and register cloud services that meet the government's security requirements. This program is based on the "Basic Framework for the Security Evaluation System for Cloud Services in Government Information Systems".
South Korea Financial Security Institute
Select SAP solutions have successfully completed the 2024 South Korea Cloud Service Providers (CSP) Safety Assessment Program, also known as the Regulation on Supervision on Electronic Financial Transactions (RSEFT) Delegated Assessment. The financial sector in South Korea is required to adhere to a variety of cybersecurity standards and regulations. Having passed the Delegated Assessment conducted by the South Korea Financial Security Institute, financial institutions in South Korea can now deploy these compliant SAP solutions to process and store data, subject to compliance with applicable security measures for financial companies.
Spain National Security Framework (ENS)
The National Security Framework (ENS) is made up of the basic principles and minimum requirements necessary for the adequate protection of the information processed and the services provided by an organization. ENS compliance helps ensure access, confidentiality, integrity, traceability, authenticity, availability and conservation of data and services processed by electronic means.
UK Cyber Essentials Certification
Cyber Essentials is a UK government backed cybersecurity Certification scheme that helps organizations protect themselves against common cyber threats. Cyber Essentials is available at the following Certification Levels:
(Level One) Cyber Essentials: A self-assessment, where organisations complete a questionnaire which is then reviewed and marked by an independent Certification body.
(Level Two) Cyber Essentials Plus: A technical audit of scoped IT systems by an independent Certification body.
SAP software accessibility
SAP provides information about the compliance of our products with US Section 508, WCAG 2.2, and EN 301 549 standards based on VPAT(R) upon request. Further details on SAP’s Accessibility Development Policy are also available.
Sustainability ISO 14001 and ISO 50001
A multisite certificate confirms that SAP’s environmental management system complies with the international ISO 14001:2015 standard. The appendix for this certificate includes all certified sites covered by SAP's environmental management system. At some sites we have a ISO50001:2018 certification, ensuring we are in line with energy management standards.
Cloud Security Alliance (CSA)
The Cloud Security Alliance (CSA), a not-for-profit organization that develops and promotes best security practices for cloud computing and provides focus and guidance for SAP deployments.
Ethics and compliance
SAP is committed to the highest standards of ethical business practices. We strive to undertake business with integrity and follow both the spirit and the letter of the law in all global markets in which we operate.
IDW PS 880
Attestations of SAP software pursuant to the German Institute of Public Auditors (IDW).
Compliance resources
Ethics and compliance at SAP
By doing business the right way, in accordance with our Global Code of Ethics and Business Conduct, SAP positively impacts social and economic development, furthering education, justice, democracy, prosperity, development, and health worldwide.
Cloud delivery processes
Get insights into our cloud delivery processes and the ways they support critical business operations for cloud services.