DORA Mapping FSA Formal V11
Digital Operational Resilience Act for Financial Entities Download the DocumentPUBLIC
SAP Agreement
For Financial Entities
DORA Project Team
Updated: 7th February 2025
SAP Agreement
For Financial Entities
DORA Project Team
Updated: 7th February 2025
© 2025 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 2 / 16
The table below represents SAP’s contractual provisions when compared to the Digital Operational Resilience Act (DORA), Article
30 Key Contractual Provisions. We are currently reviewing and enhancing our processes to meet the requirements under DORA so
we can offer you an agreement meeting the expectations of many EU financial entities. This DORA Mapping corresponds to the
DORA-ready FSA for version 11.
This document is for informational purposes, only, and although reliable, should not be relied upon for purchasing decisions. It
does not provide legal or professional advice, and SAP may modify any information expressed in this DORA Map as regulatory
and security requirements evolve. Customers are encouraged to seek independent counsel and guidance on these laws in
support of their compliance efforts.
For more information on SAP’s compliance efforts, please reference our NIS2 DORA FAQ (Frequently Asked Questions). For
additional questions, you can reach out to your sales representative.
The table below represents SAP’s contractual provisions when compared to the Digital Operational Resilience Act (DORA), Article
30 Key Contractual Provisions. We are currently reviewing and enhancing our processes to meet the requirements under DORA so
we can offer you an agreement meeting the expectations of many EU financial entities. This DORA Mapping corresponds to the
DORA-ready FSA for version 11.
This document is for informational purposes, only, and although reliable, should not be relied upon for purchasing decisions. It
does not provide legal or professional advice, and SAP may modify any information expressed in this DORA Map as regulatory
and security requirements evolve. Customers are encouraged to seek independent counsel and guidance on these laws in
support of their compliance efforts.
For more information on SAP’s compliance efforts, please reference our NIS2 DORA FAQ (Frequently Asked Questions). For
additional questions, you can reach out to your sales representative.
© 2025 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 3 / 16
Item
No.
DORA Article 30
Subsection
Supporting Information Provisions Found in the FSA Provisions found in the Cloud Services
Agreement
1 1. The rights and
obligations of the financial
entity and of the ICT third-
party service provider shall
be clearly allocated and set
out in writing. The full
contract shall include the
service level agreements
and be documented in one
written
document which shall be
available to the parties on
paper, or in a document
with another
downloadable, durable and
accessible format.
Several contract components make up one SAP agreement for the SAP
cloud service.
The contract component entitled “Service Level Agreement” details
our service level agreement and is incorporated by reference into the
Agreement.
SAP offers a contract component titled, "SAP Annex for Regulatory
Requirements", or the FSA, for financial entities subject to financial
services outsourcing regulatory requirements.
The FSA contains DORA Article 30 key contractual provisions. The FSA
supplements the Agreement terms, and when referenced and
incorporated in the Agreement, form one written document, which can
be made available on paper, or in a document with another
downloadable, durable and accessible format.
Copies of SAP’s contracts are generally available and downloadable at
the Trust Center Agreements Website.
For more information about our Agreements, including the FSA, please
reach out to the account representative.
Contains specific DORA, Article
30 Key contractual provisions.
SAP cloud service contract consists of the
following components, in its order of
precedence (Agreement):
1. SAP Cloud Order Form including Schedule
1 (Order Form).
2. Supplemental Terms and Conditions for
Cloud Services (Supplement; choose the
relevant cloud service).
3. Support Schedule for Cloud Services
(Support; choose the appropriate option)
4. Service Level Agreement for Cloud
Services (SLA; choose the relevant cloud
services)
5. Data Processing Agreement for Cloud
Services (DPA; choose the appropriate
option).
6. General Terms and Conditions for Cloud
Services (GTC; choose the appropriate
option).
Service Specifications for select cloud
services like Ariba, and Grow with SAP
S/4HANA Cloud Services
Item
No.
DORA Article 30
Subsection
Supporting Information Provisions Found in the FSA Provisions found in the Cloud Services
Agreement
1 1. The rights and
obligations of the financial
entity and of the ICT third-
party service provider shall
be clearly allocated and set
out in writing. The full
contract shall include the
service level agreements
and be documented in one
written
document which shall be
available to the parties on
paper, or in a document
with another
downloadable, durable and
accessible format.
Several contract components make up one SAP agreement for the SAP
cloud service.
The contract component entitled “Service Level Agreement” details
our service level agreement and is incorporated by reference into the
Agreement.
SAP offers a contract component titled, "SAP Annex for Regulatory
Requirements", or the FSA, for financial entities subject to financial
services outsourcing regulatory requirements.
The FSA contains DORA Article 30 key contractual provisions. The FSA
supplements the Agreement terms, and when referenced and
incorporated in the Agreement, form one written document, which can
be made available on paper, or in a document with another
downloadable, durable and accessible format.
Copies of SAP’s contracts are generally available and downloadable at
the Trust Center Agreements Website.
For more information about our Agreements, including the FSA, please
reach out to the account representative.
Contains specific DORA, Article
30 Key contractual provisions.
SAP cloud service contract consists of the
following components, in its order of
precedence (Agreement):
1. SAP Cloud Order Form including Schedule
1 (Order Form).
2. Supplemental Terms and Conditions for
Cloud Services (Supplement; choose the
relevant cloud service).
3. Support Schedule for Cloud Services
(Support; choose the appropriate option)
4. Service Level Agreement for Cloud
Services (SLA; choose the relevant cloud
services)
5. Data Processing Agreement for Cloud
Services (DPA; choose the appropriate
option).
6. General Terms and Conditions for Cloud
Services (GTC; choose the appropriate
option).
Service Specifications for select cloud
services like Ariba, and Grow with SAP
S/4HANA Cloud Services
© 2025 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 4 / 16
Item
No.
DORA Article 30
Subsection
Supporting Information Provisions Found in the
FSA
Provisions found in the Cloud
Services Agreement
2 2(a) a clear and complete
description of all functions
and ICT services to be
provided by the ICT third-
party service provider,
indicating whether
subcontracting of an ICT
service supporting a critical
or important function, or
material parts
thereof, is permitted and,
when that is the case, the
conditions applying to such
subcontracting;
Agreements outline the functions of the cloud service, including
authorizations for subcontracting and the conditions for
subcontracting, as further described in the FSA.
Documentation provides additional technical and functional
specifications concerning the respective cloud service.
Documentation is found on the Help Portal..
The Supplement outlines unique descriptions for each cloud service
and may contain specifics further describing the relative terms
outlined in the SLA, Support, DPA, and GTC.
Our Data Protection Agreement incorporates subprocessor lists as
required under many privacy laws. See the My Trust Center (log in
required) for the most current subprocessor list and to subscribe to its
updates (requires log-in).
In addition to subprocessors, SAP makes available a List of
Subcontractors involved in the provision of cloud service and
confirmed as eligible for contracting as a critical or important function.
SAP will continuously update this list, which customers can
automatically receive through subscription (requires login.)
Sections:
1. Applicability
2.4. SAP Services
2.5. Critical SAP Services
2.6. Subcontractor
4. Standards and IT Security
Standards
5. Risk Reports
6. Data Storage and Processing
Locations
8. Subcontractors
15. Information about
Developments
16. SAP’s DORA Compliance
SAP Cloud Order Form. Sections:
2. Cloud Services
5. Subscription Cloud Services, (as
applicable),
6. Additional Terms
7. Export Restrictions
8. Referenced Documents:
• Supplemental Terms and
Conditions for Cloud Services,
• Support Schedule for Cloud
Services,
• SLA,
• DPA and the linked Security
Measures for Cloud Services,
• General Terms and Conditions, and
• Schedule 1 (Pricing Summary), and
Documentation as defined in GTCs.
3 2(b) the locations, namely
the regions or countries,
where the contracted or
subcontracted functions
and ICT services are to be
provided and where data is
to be processed, including
the storage location, and
the requirement for the ICT
third-party service provider
to notify the financial entity
in advance if it envisages
changing such locations;
See Item No. 2 above for details on subcontracting conditions and
maintaining subcontractor lists., which can be found on the My Trust
Center. In addition to such obligations, SAP provides data center
locations, other storage and processing locations, and depending on
the product, specific means to limit data processing to a specific
region.
The GTC describe the changing nature of the cloud service and SAP's
obligations to notify you of such modifications.
The FSA states SAP’s responsibility for subcontractors. These
responsibilities include executing written contracts requiring
subcontractors’ notification of changes to the place or location of
activity of its service; and when it effectively underpins cloud service
confirmed as eligible for contracting as a critical or important function.
Sections:
2.6. Subcontractor
6. Data Storage and Processing
Locations
8. Subcontractors
19. Additional Terms for the Use
of Hyperscalers.
Data Protection Agreement:
Sections 4.6. Data Protection Impact
Assessment
Section 7.2. New Subprocessors
Section 8. International Processing
Item
No.
DORA Article 30
Subsection
Supporting Information Provisions Found in the
FSA
Provisions found in the Cloud
Services Agreement
2 2(a) a clear and complete
description of all functions
and ICT services to be
provided by the ICT third-
party service provider,
indicating whether
subcontracting of an ICT
service supporting a critical
or important function, or
material parts
thereof, is permitted and,
when that is the case, the
conditions applying to such
subcontracting;
Agreements outline the functions of the cloud service, including
authorizations for subcontracting and the conditions for
subcontracting, as further described in the FSA.
Documentation provides additional technical and functional
specifications concerning the respective cloud service.
Documentation is found on the Help Portal..
The Supplement outlines unique descriptions for each cloud service
and may contain specifics further describing the relative terms
outlined in the SLA, Support, DPA, and GTC.
Our Data Protection Agreement incorporates subprocessor lists as
required under many privacy laws. See the My Trust Center (log in
required) for the most current subprocessor list and to subscribe to its
updates (requires log-in).
In addition to subprocessors, SAP makes available a List of
Subcontractors involved in the provision of cloud service and
confirmed as eligible for contracting as a critical or important function.
SAP will continuously update this list, which customers can
automatically receive through subscription (requires login.)
Sections:
1. Applicability
2.4. SAP Services
2.5. Critical SAP Services
2.6. Subcontractor
4. Standards and IT Security
Standards
5. Risk Reports
6. Data Storage and Processing
Locations
8. Subcontractors
15. Information about
Developments
16. SAP’s DORA Compliance
SAP Cloud Order Form. Sections:
2. Cloud Services
5. Subscription Cloud Services, (as
applicable),
6. Additional Terms
7. Export Restrictions
8. Referenced Documents:
• Supplemental Terms and
Conditions for Cloud Services,
• Support Schedule for Cloud
Services,
• SLA,
• DPA and the linked Security
Measures for Cloud Services,
• General Terms and Conditions, and
• Schedule 1 (Pricing Summary), and
Documentation as defined in GTCs.
3 2(b) the locations, namely
the regions or countries,
where the contracted or
subcontracted functions
and ICT services are to be
provided and where data is
to be processed, including
the storage location, and
the requirement for the ICT
third-party service provider
to notify the financial entity
in advance if it envisages
changing such locations;
See Item No. 2 above for details on subcontracting conditions and
maintaining subcontractor lists., which can be found on the My Trust
Center. In addition to such obligations, SAP provides data center
locations, other storage and processing locations, and depending on
the product, specific means to limit data processing to a specific
region.
The GTC describe the changing nature of the cloud service and SAP's
obligations to notify you of such modifications.
The FSA states SAP’s responsibility for subcontractors. These
responsibilities include executing written contracts requiring
subcontractors’ notification of changes to the place or location of
activity of its service; and when it effectively underpins cloud service
confirmed as eligible for contracting as a critical or important function.
Sections:
2.6. Subcontractor
6. Data Storage and Processing
Locations
8. Subcontractors
19. Additional Terms for the Use
of Hyperscalers.
Data Protection Agreement:
Sections 4.6. Data Protection Impact
Assessment
Section 7.2. New Subprocessors
Section 8. International Processing
© 2025 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 5 / 16
Item
No.
DORA Article 30
Subsection
Supporting Information Provisions Found in the FSA Provisions found in the Cloud Services
Agreement
4 2(c) provisions on
availability, authenticity,
integrity and confidentiality
in relation to the protection
of data, including personal
data;
Please see Items 2 and 3, above, for measures concerning suppliers
and personal data.
SAP provides a status of cloud service systems at SAP for Me (log in
required). You can also find general cloud service status and
performance history on our Trust Center (cloud status).
SAP manages authenticity, integrity, and confidentiality relative to data
protection using various measures; from the implementation of
controls for access, authentication, and change management, to
enforcing enterprise policies, and procedures around the handling of
all data, including financial entity data entered into the production
systems of our cloud service.
For assurances on specific standards for cloud service and enterprise
measures, SAP publishes various certifications and attestations, such
as ISO 27001, SOC 1, SOC 2, C5, and other offerings. You can find the
available compliance offering for the respective cloud service here on
our Trust Center, Compliance website.
SAP makes available cloud service security features to manage the
availability, authenticity, integrity, and confidentiality of its data. More
information on such features is found on the Trust Center Security
website.
The means to report security incidents impacting the authentication,
availability, integrity, or confidentiality customers’ data, by submitting
such incidents through our Security Issue Management website.
Section 4. Standards and IT
Security Standards
Section 9. Security Incident
Management
Section 11. Awareness
Programs and Trainings
Section 13. Exit Management
Extended Services and
Migration Support Services
Section 14. Threat Led
Penetration Testing
Section 16. Business Continuity
Supplemental Terms and Conditions
Service Level Agreement Schedule
Data Processing Agreement
Security Measures for Cloud Services
(formerly, Technical and Organizational
Measures).
GTC Sections:
3. SAP Responsibilities and Duties
11. Confidentiality.
Item
No.
DORA Article 30
Subsection
Supporting Information Provisions Found in the FSA Provisions found in the Cloud Services
Agreement
4 2(c) provisions on
availability, authenticity,
integrity and confidentiality
in relation to the protection
of data, including personal
data;
Please see Items 2 and 3, above, for measures concerning suppliers
and personal data.
SAP provides a status of cloud service systems at SAP for Me (log in
required). You can also find general cloud service status and
performance history on our Trust Center (cloud status).
SAP manages authenticity, integrity, and confidentiality relative to data
protection using various measures; from the implementation of
controls for access, authentication, and change management, to
enforcing enterprise policies, and procedures around the handling of
all data, including financial entity data entered into the production
systems of our cloud service.
For assurances on specific standards for cloud service and enterprise
measures, SAP publishes various certifications and attestations, such
as ISO 27001, SOC 1, SOC 2, C5, and other offerings. You can find the
available compliance offering for the respective cloud service here on
our Trust Center, Compliance website.
SAP makes available cloud service security features to manage the
availability, authenticity, integrity, and confidentiality of its data. More
information on such features is found on the Trust Center Security
website.
The means to report security incidents impacting the authentication,
availability, integrity, or confidentiality customers’ data, by submitting
such incidents through our Security Issue Management website.
Section 4. Standards and IT
Security Standards
Section 9. Security Incident
Management
Section 11. Awareness
Programs and Trainings
Section 13. Exit Management
Extended Services and
Migration Support Services
Section 14. Threat Led
Penetration Testing
Section 16. Business Continuity
Supplemental Terms and Conditions
Service Level Agreement Schedule
Data Processing Agreement
Security Measures for Cloud Services
(formerly, Technical and Organizational
Measures).
GTC Sections:
3. SAP Responsibilities and Duties
11. Confidentiality.