SAP compliance, certifications and attestations
Business apps · 25 certifications held · 5 from public registries · read Sep 24, 2026
| Certification | Evidence | ||
|---|---|---|---|
| SOC reports | |||
| SOC 1 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| SOC 2 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| ISO standards | |||
| ISO/IEC 27001 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| ISO/IEC 27017 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| ISO/IEC 27018 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| ISO 9001 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| ISO 22301 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| AI governance | |||
| ISO/IEC 42001 Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| US government | |||
| FedRAMP Moderate DoD Cloud Intelligent Enterprise – DD-CIE; SAP NS2 Cloud Intelligent Enterprise FedRAMP Marketplace | Moderate | FedRAMP Marketplace | Sep 23, 2026 |
| GovRAMP (StateRAMP) Moderate Cloud Intelligent Enterprise (Authorized, Moderate); Concur Travel and Expense (Progressing, Moderate) GovRAMP product list | Moderate | GovRAMP product list | Sep 24, 2026 |
| CMMC 2.0 Held Vendor pageUnverified | Held | Vendor pageUnverified | Sep 24, 2026 |
| FIPS 140 validated FIPS 140-3 1 active FIPS 140-3 module: #5093 SAP CommonCryptoLib Crypto Kernel NIST CMVP | FIPS 140-3 | NIST CMVP | Sep 24, 2026 |
| Section 508 / VPAT Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| Finance | |||
| PCI DSS Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| DORA Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| Health | |||
| HDS (France) Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| Life sciences (GxP) | |||
| GxP qualification Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| Privacy and cloud | |||
| EU Cloud Code of Conduct Held Partner entry in the STAR Registry CSA STAR Registry and vendor page | Held | CSA STAR Registry and vendor page | Sep 24, 2026 |
| CSA STAR Level 2 CAIQ, certification CSA STAR Registry | Level 2 | CSA STAR Registry | Sep 23, 2026 |
| Regional programs | |||
| Cyber Essentials (UK) Plus Vendor page | Plus | Vendor page | Sep 24, 2026 |
| BSI C5 (Germany) Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| ENS (Spain) Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| IRAP (Australia) Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| ISMAP (Japan) Held Vendor page | Held | Vendor page | Sep 24, 2026 |
| TISAX Held Vendor page | Held | Vendor page | Sep 24, 2026 |
From public trust centers and registries on the date shown. Confirm scope with the vendor. Logos via logo.dev; trademarks belong to their owners.
History
| Date | Change | |
|---|---|---|
| Added FedRAMP Moderate SAP NS2 Cloud Intelligent Enterprise | FedRAMP Marketplace | |
| Added FedRAMP Moderate DoD Cloud Intelligent Enterprise – DD-CIE | FedRAMP Marketplace | |
| In process FedRAMP Moderate SAP NS2 Cloud Intelligent Enterprise | FedRAMP Marketplace | |
| Added CSA STAR First listed in the CSA STAR Registry | CSA STAR Registry | |
| In process FedRAMP Moderate DoD Cloud Intelligent Enterprise – DD-CIE | FedRAMP Marketplace |
About SAP
ERP, SAP Business Technology Platform and Joule.
- Status
- Public
- Headquarters
- Walldorf, Germany
- Founded
- 1972
- Website
- sap.com
No public evidence found for
- SOC reports
- SOC 3
- ISO standards
- ISO 27701, ISO 20000, ISO 27799
- AI governance
- STAR AI
- US government
- DoD IL, TX-RAMP, 800-171, 800-53, ITAR, CJIS, IRS 1075
- Finance
- PCI 3DS, SWIFT, 17a-4, GLBA, SOX, FFIEC, MAS TRM, APRA, OSFI, FISC
- Health
- HIPAA, HITRUST, NHS DSPT, PHIPA
- Life sciences (GxP)
- Part 11, Annex 11, CSV
- Privacy and cloud
- DPF, CBPR
- Regional programs
- G-Cloud, SecNum, MTCS, K-ISMS
- Education
- FERPA, HECVAT, COPPA
Compare with ServiceNow, Workday, Dropbox, Slack, Figma