SAP compliance, certifications and attestations

An auditor's report on controls relevant to customers' financial reporting.

HeldVendor page

An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.

HeldVendor page

A certified information security management system.

HeldVendor page

Cloud-specific security controls on top of ISO 27001.

HeldVendor page

Protection of personal data in public clouds acting as processors.

HeldVendor page

A certified quality management system.

HeldVendor page

A certified business continuity management system.

HeldVendor page

A certified AI management system: how a company governs the AI it builds or uses.

HeldVendor page

Authorization to sell a cloud service to US federal agencies.

ModerateFedRAMP MarketplaceDoD Cloud Intelligent Enterprise – DD-CIE; SAP NS2 Cloud Intelligent Enterprise

A security verification for US state and local government cloud buyers.

ModerateGovRAMP product listCloud Intelligent Enterprise (Authorized, Moderate); Concur Travel and Expense (Progressing, Moderate)

Cybersecurity Maturity Model Certification for the defense supply chain.

HeldUnverifiedVendor page

Cryptographic modules validated under FIPS 140-2 or 140-3.

FIPS 140-3NIST CMVP1 active FIPS 140-3 module: #5093 SAP CommonCryptoLib Crypto Kernel

Accessibility conformance reports (VPAT) for US federal buyers.

HeldVendor page

Validated compliance with the card industry data security standard.

HeldVendor page

Readiness for the EU Digital Operational Resilience Act for financial entities.

HeldVendor page

Certification to host personal health data in France (Hébergeur de Données de Santé).

HeldVendor page

Support for regulated life-sciences workloads under GMP, GCP and GLP.

HeldVendor page

Adherence to the GDPR code of conduct for cloud processors.

HeldCSA STAR Registry and vendor pagePartner entry in the STAR Registry

A listing in the Cloud Security Alliance STAR Registry.

Level 2CSA STAR RegistryCAIQ, certification

The UK government-backed baseline security certification.

PlusVendor page

An attestation against Germany's Cloud Computing Compliance Criteria Catalogue.

HeldVendor page

Certification under Spain's Esquema Nacional de Seguridad.

HeldVendor page

An assessment by an ASD-endorsed assessor for Australian government data.

HeldVendor page

Registration on Japan's government cloud security list.

HeldVendor page

An assessment shared through the German automotive industry's exchange.

HeldVendor page