Priorities and scope
Critical covers configurations with particularly significant security impact. Standard represents the typical protection level. Extended requires an explicit decision to adopt additional safeguards. Practice identifies organizational or technical guidance without assigning a requirement class.
Five layers of responsibility
Environment covers networks, operating systems and client devices. System addresses hardening, updates and monitoring. Application covers identities, authentication, roles and custom code. Process includes data protection, compliance and auditing. Organization defines governance, awareness and risk management.
Connect risks to controls
For each system, identify the owner, requirement, target value, verification method and evidence. Map privileged access to CRITAU, uncontrolled changes to CHANGE, missing event trails to AUDIT, and weak authentication to PWDPOL, SSO and IDPROV. This register supports security review; it is not itself a compliance certification.
Exceptions and review cycles
For a deviation, record the justification, risk owner, compensating control and reassessment date. Start with a manageable set of Critical and Standard controls, then add selected Extended controls. Repeat the review after changes, upgrades and changes in system use.
Controls to review
Critical authorizations
Restrict privileges that can change data, code, identities and configuration.
Production and transport protection
Lock down production changes and retain a configuration change trail.
Security Audit Log and platform auditing
Record events needed for incident detection and retrospective analysis.
Password policies
Establish a consistent password policy for ABAP, Java and HANA.
Security updates
Maintain an update cycle and timely handling of SAP Security Notes.