Guide to SAP cloud security and compliance controls
This will be used as a link in the Trust Center Overview page. Descargue el documento
This will be used as a link in the Trust Center Overview page. Trust Center
Guide to SAP Cloud Security and Compliance Controls
Thank you for your interest in SAP's cloud security and compliance controls. At SAP, we
understand that your due diligence activities are critical to ensuring the security and
compliance of your operations. We are committed to supporting your efforts by providing a
wide range of resources designed to assist you with both internal and external audits.
Our Commitment to Transparency and Security
At SAP, we believe in maintaining transparency with our customers. We are dedicated to
demonstrating the robustness of our security posture, ensuring that you have access to the
information necessary for your verification processes. To this end, we offer a variety of
resources that can significantly aid your due diligence activities.
Guide to SAP Cloud Security and Compliance Controls
Thank you for your interest in SAP's cloud security and compliance controls. At SAP, we
understand that your due diligence activities are critical to ensuring the security and
compliance of your operations. We are committed to supporting your efforts by providing a
wide range of resources designed to assist you with both internal and external audits.
Our Commitment to Transparency and Security
At SAP, we believe in maintaining transparency with our customers. We are dedicated to
demonstrating the robustness of our security posture, ensuring that you have access to the
information necessary for your verification processes. To this end, we offer a variety of
resources that can significantly aid your due diligence activities.
© 2024 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 2 / 4
Standard Security Documentation and Independent Assessments
As part of our cloud services, SAP provides standard security documentation along with
independent third-party assessments based on recognized industry standards. These
resources are designed to meet the needs of most organizations, enabling you to save time
and effort by utilizing these pre-prepared documents rather than developing bespoke
questionnaires.
Confidentiality and Security
While we strive to provide as much transparency as possible, it is essential for the security of
all our customers that some information remains confidential. We carefully balance the need
for transparency with the requirement to protect sensitive data, ensuring that all of our
customers can trust the integrity of our security measures.
Standard Security Documentation and Independent Assessments
As part of our cloud services, SAP provides standard security documentation along with
independent third-party assessments based on recognized industry standards. These
resources are designed to meet the needs of most organizations, enabling you to save time
and effort by utilizing these pre-prepared documents rather than developing bespoke
questionnaires.
Confidentiality and Security
While we strive to provide as much transparency as possible, it is essential for the security of
all our customers that some information remains confidential. We carefully balance the need
for transparency with the requirement to protect sensitive data, ensuring that all of our
customers can trust the integrity of our security measures.
© 2024 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 3 / 4
Resources Available for Your Due Diligence
To help you perform thorough due diligence, SAP offers the following resources:
• Cloud Security Alliance Questionnaire (CAIQ): We provide access to
industrystandard cloud security questionnaires, consisting of 260 questions, with SAP's
answers published on the CSA STAR Registry website
(https://cloudsecurityalliance.org/star/).
These resources are designed to streamline your verification process.
• Certifications & Attestations: SAP maintains multiple certifications and attestations,
including SOC 2, ISO/IEC 27001, and ISO 22301.
These certifications are available on the SAP Trust Center
(https://www.sap.com/trust-center/certification-compliance.html), where you can
access detailed information about our compliance with these standards.
Due to the requirements of our auditors, customers must request some of these reports
themselves; SAP staff are not permitted to send them directly to customers.
• Independent cybersecurity scorecards: SAP has completed maturity assessments
on Third Party Risk Management platforms, such as Cybervadis and ProcessUnity.
To request access to these reports please contact your SAP Account Executive directly.
We do not currently take requests for reports made in the platforms themselves.
• Contractual Assurance: Our Terms of Use (TOMs) and Data Processing Agreement
(DPA) outline our contractual commitments related to security. Your specific contract
will detail our commitments to your organisation, ensuring clarity and peace of mind.
Resources Available for Your Due Diligence
To help you perform thorough due diligence, SAP offers the following resources:
• Cloud Security Alliance Questionnaire (CAIQ): We provide access to
industrystandard cloud security questionnaires, consisting of 260 questions, with SAP's
answers published on the CSA STAR Registry website
(https://cloudsecurityalliance.org/star/).
These resources are designed to streamline your verification process.
• Certifications & Attestations: SAP maintains multiple certifications and attestations,
including SOC 2, ISO/IEC 27001, and ISO 22301.
These certifications are available on the SAP Trust Center
(https://www.sap.com/trust-center/certification-compliance.html), where you can
access detailed information about our compliance with these standards.
Due to the requirements of our auditors, customers must request some of these reports
themselves; SAP staff are not permitted to send them directly to customers.
• Independent cybersecurity scorecards: SAP has completed maturity assessments
on Third Party Risk Management platforms, such as Cybervadis and ProcessUnity.
To request access to these reports please contact your SAP Account Executive directly.
We do not currently take requests for reports made in the platforms themselves.
• Contractual Assurance: Our Terms of Use (TOMs) and Data Processing Agreement
(DPA) outline our contractual commitments related to security. Your specific contract
will detail our commitments to your organisation, ensuring clarity and peace of mind.
© 2024 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 4 / 4
Additional Information:
We offer further details on the SAP Trust Center (https://www.sap.com/trust-center.html) and
SAP My Trust Center (https://www.sap.com/my-trust-center.html) (requires S-User ID),
including the SAP Global Security Policy, a list of sub-processors, and various white papers on
security topics.
Solution-Specific Resources
Please note that the specific resources available may vary depending on the solution you are
using. We recommend visiting the SAP Trust Center regularly for the most up-to-date
information related to your specific services.
Need Further Assistance?
We hope that the access to our comprehensive information will streamline your verification
process. Should you require any further assistance or wish to discuss these matters in more
detail, please do not hesitate to reach out via your account team.
If you have any additional questions or need to submit a specific questionnaire, our team is
here to support you. Your account team will be your point of contact to ensure that your needs
are met.
By adopting these standardized approaches, you can improve transparency, simplify your
auditing processes, and ensure a consistent approach to your assessments. Our goal is to
make the verification process as straightforward and efficient as possible.
Additional Information:
We offer further details on the SAP Trust Center (https://www.sap.com/trust-center.html) and
SAP My Trust Center (https://www.sap.com/my-trust-center.html) (requires S-User ID),
including the SAP Global Security Policy, a list of sub-processors, and various white papers on
security topics.
Solution-Specific Resources
Please note that the specific resources available may vary depending on the solution you are
using. We recommend visiting the SAP Trust Center regularly for the most up-to-date
information related to your specific services.
Need Further Assistance?
We hope that the access to our comprehensive information will streamline your verification
process. Should you require any further assistance or wish to discuss these matters in more
detail, please do not hesitate to reach out via your account team.
If you have any additional questions or need to submit a specific questionnaire, our team is
here to support you. Your account team will be your point of contact to ensure that your needs
are met.
By adopting these standardized approaches, you can improve transparency, simplify your
auditing processes, and ensure a consistent approach to your assessments. Our goal is to
make the verification process as straightforward and efficient as possible.