SAP security checklist: 12 controls every SAP landscape needs

System hardening

1. Secure profile parameters: password rules, login restrictions and secure defaults set consistently on every system.
2. Disable or protect standard users, and change default passwords on every client.
3. Restrict ICF services to the ones you actually use.
4. Secure the SAP gateway and message server with access control lists.

Patching

1. Review SAP Security Notes every month, after SAP's Security Patch Day on the second Tuesday, and apply the relevant ones through your change process.
2. Keep the SAP kernel, SAP HANA and the operating system on supported, patched levels.

Users and authorizations

1. Design roles on least privilege, and review critical authorizations and powerful profiles regularly.
2. Check segregation of duties for key processes such as purchasing, payments and user administration.
3. Remove or lock users who have left, and review firefighter and emergency access.

Interfaces and encryption

1. Review RFC destinations: no stored passwords where they are not needed, and trusted connections only where intended.
2. Encrypt communication with SNC for SAP GUI and RFC, and TLS for HTTP connections, and monitor certificate expiry.

Logging and audit readiness

1. Activate and review the Security Audit Log, and keep logs long enough for your audit and GDPR obligations.

Auditors usually ask for user and authorization reports, change logs, evidence of patching and security configuration. Having these ready saves days during an audit.

Make it continuous

Security is not a one-time project. A short monthly routine, covering security notes, new users and roles, failed logins and certificate expiry, keeps the landscape in a known state. Monitoring platforms with role-based access and an audit trail help prove who did what.