SAP Cloud Infrastructure Cloud Computing Compliance Criteria Catalog (C5:2020) Audit Report 2023 H1

SAP Converged Cloud

Converged Cloud is SAP’s standardized Infrastructure as a Service (IaaS) offering to support all of SAP’s cloud business on a global scale. SAP Converged Cloud provides access to a vendor-agnostic hardware infrastructure architecture as well as infrastructure orchestration and automation services in all SAP. With SAP Converged Cloud, it is possible to deploy applications into data centers without needing to deploy a solution-specific infrastructure stack (the application infrastructure) beforehand.

The SAP Converged Cloud infrastructure landscape is hosted either in SAP SE owned data centers or co-location data centers, as detailed below:

DC Locations	DC Providers
United Arab Emirates: Dubai	Co-Location Provider
United Arab Emirates: Dubai	Co-Location Provider
Australia: Sydney	Co-Location Provider
Australia: Sydney	Co-Location Provider
Australia: Sydney	Co-Location Provider
China: Shanghai	Co-Location Provider
China: Shanghai	Co-Location Provider
China: Shanghai	Co-Location Provider
Japan: Tokyo	Co-Location Provider
Japan: Osaka	Co-Location Provider
Saudi Arabia: Riyadh	Co-Location Provider
Saudi Arabia: Dammam	Co-Location Provider
Germany: St. Leon-Rot	SAP
Germany: St. Leon-Rot	SAP
Germany: Walldorf	SAP
Germany: Frankfurt	Co-Location Provider
Germany: Frankfurt	Co-Location Provider
Netherlands: Amsterdam	Co-Location Provider
Netherlands: Amsterdam	Co-Location Provider
Brazil: São Paulo	Co-Location Provider
Canada: Toronto	Co-Location Provider
Canada: Toronto	Co-Location Provider
USA: Ashburn, VA	Co-Location Provider
USA: Newtown Square, PA	SAP
USA: Sterling, VA	Co-Location Provider
USA: Sterling, VA	Co-Location Provider
USA: Colorado Springs, CO	SAP
USA: Colorado Springs, CO	SAP
USA: Chandler, AZ	Co-Location Provider

SAP Multi Cloud

The SAP Multi Cloud organization provides a ‘platform of enablement’ for Lines of Business (LoB) in the public cloud, providing costing services such as billing and cost optimization, architecture consultation and application design and security safeguards, tool engineering to automate and expand services offerings and hyperscaler operational support.

The SAP Multi Cloud infrastructure landscape is hosted either in SAP SE owned data centers or co-location data centers, as detailed below:

Infrastructure Provider	Location
AWS	USA: N. Virginia
AWS	USA: NS2 Federal Civilian
AWS	USA: NS2 DoD
AWS	Ireland
AWS	Canada: Central
AWS	Singapore
AWS	South Korea: Seoul
AWS	Japan: Osaka
AWS	France: Paris
AWS	Sweden: Stockholm
AWS	China: Beijing
AWS	USA: N. California
AWS	Bahrain
AWS	United Arab Emirates
AWS	Germany: Frankfurt
AWS	Spain
AWS	China: Hong Kong
AWS	Italy: Milan
AWS	Indonesia: Jakarta
AWS	UK: London
AWS	India: Mumbai
AWS	China: Ningxia
AWS	USA: Ohio
AWS	Brazil: São Paulo
AWS	South Africa: Cape Town
AWS	Australia: Sydney
AWS	Japan: Tokyo
AWS	India: Hyderabad
AWS	USA: Oregon
AWS	Australia: Melbourne
AWS	Switzerland: Zurich
GCP	Israel: Tel Aviv
GCP	USA: Council Bluffs, IA
GCP	USA: The Dalles, OR
GCP	USA: Ashburn, VA
GCP	USA: Moncks Corner, SC
GCP	Belgium: St. Ghislain
GCP	UK: London
GCP	Singapore: Jurong West
GCP	Taiwan: Changhua County
GCP	Japan: Tokyo
GCP	Australia: Sydney
GCP	Germany: Frankfurt
GCP	USA: Los Angeles, CA
GCP	Canada: Montreal
GCP	China: Hong Kong
GCP	India: Mumbai
GCP	Finland: Hamina
GCP	Netherlands: Eemshaven
GCP	Brazil: São Paulo
GCP	Japan: Osaka
GCP	Switzerland: Zürich
GCP	South Korea: Seoul
GCP	Indonesia: Jakarta
GCP	USA: Salt Lake City, UT
GCP	USA: Las Vegas, NV
GCP	Poland: Warsaw
GCP	Australia: Melbourne
GCP	India: Delhi
GCP	Canada: Toronto
GCP	Chile: Santiago
GCP	France: Paris
GCP	Italy: Milan
GCP	Spain: Madrid
GCP	USA: Columbus, OH
GCP	USA: Dallas, TX
Azure	USA: California
Azure	USA: Virginia
Azure	USA: Virginia
Azure	USA: Iowa
Azure	USA: Illinois
Azure	USA: Texas
Azure	USA: West Central
Azure	USA: Quincy, WA
Azure	USA: Virginia
Azure	USA: Iowa
Azure	USA: DoD East
Azure	USA: DoD Central
Azure	Canada: Quebec City
Azure	Canada: Toronto
Azure	Brazil: São Paulo
Azure	USA: Arizona
Azure	USA: Texas
Azure	Ireland: Dublin
Azure	Netherlands: Amsterdam
Azure	Germany: Magdeburg
Azure	UK: Cardiff
Azure	UK: London
Azure	France: Paris
Azure	France: Marseille
Azure	Singapore
Azure	China: Hong Kong
Azure	Australia: New South Wales
Azure	Australia: Victoria
Azure	China: Shanghai
Azure	China: Beijing
Azure	India: Pune
Azure	India: Mumbai
Azure	India: Chennai
Azure	Japan: Tokyo
GCP	Qatar: Doha
GCP	Italy: Turin
Azure	Japan: Osaka
Azure	South Korea: Seoul
Azure	Sout Korea: Busan
Azure	South Africa: Cape Town
Azure	South Africa: Johannesburg
Azure	Australia: Canberra
Azure	Australia: Canberra
Azure	China: Shanghai
Azure	China: Beijing
Azure	United Arab Emirates: Abu Dhabi
Azure	United Arab Emirates: Dubai
Azure	Germany: North
Azure	Germany: Frankfurt
Azure	Switzerland: Zürich
Azure	Switzerland: Geneva
Azure	Norway: Oslo
Azure	Norway: Stavanger
Azure	Sweden: Staffanstorp
Azure	Sweden: Gävle
Azure	Brazil: Rio de Janeiro
Azure	Qatar: Doha
Azure	USA: Arizona
Azure	China: Hebei
Azure	China: Jiangsu

The Cloud Computing Compliance Controls Catalogue (abbreviated “C5”) is intended primarily for cloud service providers as well as their customers and auditors. It is defined which requirements (also referred to as controls in this context) the cloud providers have to comply with or which minimum requirements the cloud providers should be obliged to meet. The catalogue is divided into 17 thematic sections (e.g. organization of information security, physical security). The surrounding parameters provide additional information on the data location, provision of services, place of jurisdiction, certifications and duties of investigation and disclosure towards government agencies and contain a system description.

SAP Cloud Infrastructure has prepared C5 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers the audit period October 1, 2022 to March 31, 2023.

The use of these reports is restricted. A copy of this report is available for all SAP customers and prospects with non-disclosure agreement in place.