SAP Business Technology Platform Cloud Computing Compliance Criteria Catalog (C5:2020) Audit Report 2023 H1

SAP Business Technology Platform (SAP BTP) is a technology platform that brings together application development, data and analytics, integration, automation, and AI capabilities in one unified environment. The platform offers users the ability to turn data into business value, compose end-to-end business processes, and build and extend SAP applications.

The services and solutions of SAP BTP are available on multiple cloud infrastructure providers. The multi-cloud foundation supports different environments, such as Cloud Foundry, ABAP, Kyma, and Neo, as well as multiple different regions and a broad choice of programming languages.

 

SAP BTP C5 Type 2 report covers within audit period the following services:

  • SAP BTP Runtime:

    • SAP BTP, Neo runtime

    • SAP BTP, Cloud Foundry runtime 

    • SAP BTP, Kyma runtime

  • SAP BTP, ABAP environment

  • SAP BTP, Kubernetes environment (internal only)

  • SAP AI Core

  • SAP AI Launchpad

  • SAP Alert Notification service for SAP BTP

  • SAP Analytics Cloud including SAP Digital
    Boardroom and SAP Analytics Hub

  • SAP Application Logging Service for SAP
    BTP

  • SAP ASE service

  • SAP Audit Log service

  • SAP Authorization and Trust Management
    service

  • SAP Automation Pilot

  • SAP Batch Release Hub
    for Life Sciences

  • SAP Build Work Zone, advanced edition
    (called «SAP Work Zone» until November 2022) 

  • SAP Build Work Zone, standard edition (called «SAP Launchpad service» until January 2023) 

  • SAP Business Accelerator Hub (called « SAP API Business Hub» until April 2023) 

  • SAP Business Application Studio

  • SAP Business Network Asset Collaboration

  • SAP Business Network for Logistics, offered as a bundle and as single services:

    • SAP Business Network Freight Collaboration

    • SAP Business Network Global Track and Trace

    • SAP Business Network Intelligent Insights

    • SAP Business Network Material Traceability

  • SAP Cloud Appliance Library

  • SAP Cloud for Energy

  • SAP Cloud Identity Access Governance

  • SAP Cloud Identity Services - Identity Authentication

  • SAP Cloud Identity Services - Identity Provisioning

  • SAP Cloud Integration for data services

  • SAP Cloud Management service for SAP BTP

  • SAP Cloud Portal service

  • SAP Cloud Transport Management

  • SAP Connectivity service

  • SAP Content Agent service

  • SAP Continuous Integration and Delivery

  • SAP Conversational AI

  • SAP Credential Store

  • SAP Custom Domain service

  • SAP Data Custodian

  • SAP Data Intelligence

  • SAP Data Privacy Integration

  • SAP Data Quality Management

  • SAP Data Retention Manager

  • SAP Datasphere (called until March 2023 « SAP Data Warehouse Cloud »), incl. SAP BW Bridge

  • SAP Destination service

  • SAP Digital Manufacturing Cloud

  • SAP Document Center

  • SAP Document Management service offered as a bundle and as single services:

    • SAP Document Management service, integration option

    • SAP Document Management service, application option

  • SAP Document service

  • SAP Entitlement Management

  • SAP Event Mesh

  • SAP Feature Flags service

  • SAP Fiori Cloud

  • SAP Forms service by Adobe

  • SAP Git service

  • SAP Graph

  • SAP HANA Cloud, offered as a bundle and as single services:

    • SAP HANA Cloud, data lake

    • SAP HANA Cloud, SAP HANA database

  • SAP HANA service for SAP BTP

  • SAP HANA spatial services

  • SAP HTML5 Application Repository service for SAP BTP

  • SAP Information Collaboration Hub (Excluding Russia MDLP domestic reporting and Saudi Arabia Reporting)

  • SAP Integration Suite, offered as a bundle and as single services:

    • SAP API Management

    • Cloud Integration

    • Integration Advisor

    • Open Connectors

  • SAP Intelligent Robotic Process Automation

  • SAP Job Scheduling service

  • SAP Keystore service

  • SAP Landscape Management Cloud

  • SAP Leonardo Machine Learning Foundation

  • SAP Malware Scanning service

  • SAP Market Communication for Utilities

  • SAP Market Rates Management:

    • SAP Market Rates Management, Bring your own rates

    • SAP Market Rates Management, Refinitiv data option

  • SAP Master Data Governance, cloud edition

  • SAP Master Data Integration

  • SAP Mobile Services (incl. Agentry)

  • SAP Monitoring service for SAP BTP

  • SAP Multi-Bank Connectivity

  • SAP OData Provisioning

  • SAP Personal Data Manager

  • SAP Platform Identity Provider service for SAP BTP

  • SAP Private Link service

  • SAP Service Manager

  • SAP Software-as-a-Service Provisioning service

  • SAP Solutions Lifecycle Management service for SAP BTP

  • SAP Sports One

  • SAP Subscription Billing

  • SAP Task Center

  • SAP Usage Data Management service for SAP BTP

  • SAP Virtual Machine service

  • SAP Web IDE

  • SAP Workflow Management offered as a bundle and as single services:

    • SAP Business Rules

    • SAP Process Visibility service

    • Workflow service

  • Application Autoscaler

  • Business Entity Recognition

  • Commercial Infrastructure Service (internal only)

  • Data Attribute Recommendation

  • Document Classification

  • Document Information Extraction

  • Invoice Object Recommendation

  • Java Application Lifecycle Management for SAP BTP

  • Java Debugging for SAP BTP 

  • Java Profiling for SAP BTP

  • MongoDB on SAP BTP

  • OAuth 2.0 on SAP BTP

  • Object Store on SAP BTP

  • PostgreSQL on SAP BTP / PostgreSQL on SAP BTP, hyperscaler option

  • RabbitMQ on SAP BTP

  • Redis on SAP BTP / Redis on SAP BTP, hyperscaler option

  • Service Ticket Intelligence

  • UI Theme Designer

  • UI5 flexibility for key users

  • Unified Gateway (internal only)

The following locations and their IaaS provider are covered:

The Cloud Computing Compliance Controls Catalogue (abbreviated “C5”) is intended primarily for cloud service providers as well as their customers and auditors. It is defined which requirements (also referred to as controls in this context) the cloud providers have to comply with or which minimum requirements the cloud providers should be obliged to meet. The catalogue is divided into 17 thematic sections (e.g. organization of information security, physical security). The surrounding parameters provide additional information on the data location, provision of services, place of jurisdiction, certifications and duties of investigation and disclosure towards government agencies and contain a system description.

 

SAP Business Technology Platform has prepared C5 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers the audit period October 1, 2022 to March 31, 2023.

 

The use of these reports is restricted. A copy of this report is available for all SAP customers and prospects with non-disclosure agreement in place.