Making sense of shared responsibility

I’m often asked a version of the same question: “Wait, doesn’t SAP handle that?” I hear it regularly from customers running cloud ERP, especially those running SAP Cloud ERP Private. But not during demos, not during go-live—months later, when the system is live, and real life kicks in.

The root cause is almost always the same. The “shared responsibility model” sounds clear…until you actually have to operate ERP in the cloud. So, let me explain.

Shared responsibility in the private cloud: What’s often misunderstood

On paper, the shared responsibility model is logical. It reflects the reality that operating ERP in the cloud is neither fully outsourced nor fully self‑managed. Some responsibilities shift to SAP, others remain with the customer, and some sit somewhere in between.

The challenge is that this model is usually explained at a high level—well before anyone has to operate the system day to day. Once the system is live, theory meets reality, and the questions start piling up. Customers often discover that “shared” doesn’t always mean “clear.” For example, the following questions still remain:

• Who handles what by default?
• What services can I request as optional?
• What do we still need to do ourselves?

The easiest way to make shared responsibility actionable is to organize it into clear service areas.

Understanding the five service categories

To help organizations shape shared responsibility around their own realities, SAP provides a roles and responsibilities matrix for SAP Cloud ERP Private operations, built around five service categories.

Let’s walk through them.

1. Standard services: Basics you shouldn’t worry about

Standard services are exactly what they sound like—the fundamentals that are always included. These are the foundational pieces you’d expect by default:

• Core system availability
• Critical technical operations
• Platform stability and security

You don’t request these or negotiate for them every time. They’re simply part of running ERP in the cloud. If SAP Cloud ERP Private were a car, standard services would be the engine, brakes, and steering wheel. You don’t customize them, you rely on them.

2. Optional services: Choose based on your reality

This is where SAP Cloud ERP Private starts to adapt to your situation. Optional services aren’t included by default, but they’re available if you need them.

Examples might include:

• Extended operational coverage
• Specific system monitoring
• Capacity or performance-related services

Some organizations are perfectly fine without them. Others—especially larger or regulated businesses—see them as essential. Optional services exist to enable different operating models, not force everyone into the same one.

3. Additional services: When something unusual comes up

Then there are moments that don’t fit neatly into day-to-day operations. Additional services cover one-off or ad-hoc requests—the rare occurrences or situations that don’t happen every month, but must be addressed when they do. These offerings are:

• Not part of standard services
• Not ongoing, like optional services
• Explicitly requested and scoped

This category is often misunderstood, but highlights a practical truth: SAP acknowledges that not everything can be predicted upfront.

4. Packaged (delegated) services: What you hand off on strategically

Some operational tasks could be done by your internal team, but you may decide against it. That’s where packaged services come in. These are services intentionally delegated to SAP and contracted separately.

This isn’t about capability, it’s about focus. Many customers choose this route so their teams can spend more time on business processes and less on operational overhead.

5. Excluded services: What never falls under SAP’s scope

Finally, and this part matters more than people would like to admit: excluded services are exactly that—excluded.

These responsibilities:

• Are never performed by SAP
• Don’t apply to all customers

This often includes areas like:

• Internal governance decisions
• Business-specific security policies
• Organizational change management

SAP Cloud ERP Private simplifies a lot, but it doesn’t replace all ownership. An example I’ve seen more than once is a customer assumes a certain operational task is included, while SAP assumes it’s either optional or customer-owned.

Nobody’s wrong—they’re just using different mental models. But if the conversation shifts to “Is this standard, optional, additional, delegated, or excluded?” in the beginning, then you’re addressing the issue directly and avoid misunderstandings later.

Knowing the right questions to ask

If you’re running (or planning to run) ERP in the cloud, these are the questions you should ask your cloud provider:

• Which services are standard by design?
• Do we need any of the optional services?
• What additional services could be useful for us now or in the future?
• What can we delegate to the provider, and which packaged services enable that?
• What responsibilities do we fully own, no matter what, and are always excluded from provided services?

Asking these questions upfront gives you a clear understanding of service boundaries and responsibilities, helping you both avoid surprises and make informed decisions.

SAP Cloud ERP Private: Clear ownership

SAP Cloud ERP Private works best when responsibilities and ways of working are clear—not a mystery managed by “someone else.” The real value comes from understanding how responsibilities and control are structured. With that structure in place, cloud ERP becomes simpler to manage, predictable, and unleashes its full potential.

Learn more about operating ERP in the cloud with confidence and control in this SAP guide.