SAP Trust Center

The scope of this C5 report includes SAP Enterprise Management System, SAP S/4HANA Cloud, SAP Marketing Cloud, and SAP Integrated Business Planning as offered in the primary data centers in Ashburn (US), Amsterdam, (The Netherlands), Colorado Springs (US), Sydney (Australia), Toronto (Canada), Dubai (UAE), Frankfurt (Germany), Newtown Square (US), Riyadh (Saudi Arabia), St. Leon-Rot (Germany), Shanghai (China), Sterling (US), Tokyo (Japan), Council Bluffs (US) and Sao Paulo (Brazil). 

SAP Product Engineering (PE) department consists of product management, engineering, cloud operations and infrastructure. PE supports teams to consolidate and operate the organization with the objective to be able to respond to changes, challenges and trends in the cloud industry and to customer expectations. The portfolio includes the SAP S/4 HANA Cloud suite, SAP Digital Supply Chain, Small and Mid-Sized Enterprises (SME), and industry solutions as well as cloud offerings. Cross-functions in the Product Engineering (PE) include Architecture, global SAP Labs Network, SAP Knowledge & Education, Globalization Services, and SAP User Experience teams with the responsibility for the overall quality of SAP software products.

The Cloud Computing Compliance Controls Catalogue (C5) is intended primarily for cloud service providers as well as their customers and auditors. It is defined which requirements (also referred to as controls in this context) the cloud providers have to comply with or which minimum requirements the cloud providers should be obliged to meet. The catalogue is divided into 17 thematic sections (e.g. organization of information security, physical security). The surrounding parameters provide additional information on the data location, provision of services, place of jurisdiction, certifications and duties of investigation and disclosure towards government agencies and contain a system description.

SAP Enterprise Management System has prepared C5 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers from 1. November 2021 to 30. September 2022, the primary data centers in locations Ashburn (US), Amsterdam, (The Netherlands), Colorado Springs (US), Sydney (Australia), Toronto (Canada), Dubai (UAE), Frankfurt (Germany), Newtown Square (US), Riyadh (Saudi Arabia), St. Leon-Rot (Germany), Shanghai (China), Sterling (US), Tokyo (Japan), Council Bluffs (US) and Sao Paulo (Brazil). 

The use of this report is restricted. A copy of this report is available for all SAP Enterprise Management System customers with productive systems. This report is also available for prospective customers under the signed non-disclosure agreement.