SAP on a Secret Mission

With the VS-NfD certification, SAP aims to strengthen its sovereign cloud portfolio for government agencies and regulated industries and enable the secure operation of security-critical SAP and customer applications in the cloud.

This makes SAP one of the few providers in Germany with a cloud offering whose key security components have been granted the appropriate authorization for use by the BSI—and currently the only provider whose platform can run both SAP applications and customer-specific applications in a timely, high-performance manner that complies with VS-NfD standards.

ISO 27001 Framework

The operating license applies to SAP Cloud Infrastructure workloads in SAP’s own data centers in the Walldorf/St. Leon-Rot region, which are operated exclusively by security-cleared personnel. According to a press release from SAP, this is intended to serve as an important intermediate step and lay the foundation for subsequent full BSI certification, including the recertification of SAP Cloud Infrastructure to ISO 27001 based on IT-Grundschutz.

„The VS-NfD operating license confirms the performance and security of our SAP Cloud Infrastructure, even for the most demanding regulatory requirements. It demonstrates that sovereign cloud innovations and maximum security are not mutually exclusive but can be purposefully combined, enabling our customers to run even highly sensitive applications flexibly and efficiently in the cloud,“ explains Martin Merz, President of SAP Sovereign Cloud. The evaluation process was completed in just about twelve months and was characterized by close, constructive collaboration between the BSI and SAP—a sign of the growing cooperation between government agencies and industry in the field of IT security. SAP Cloud Infrastructure is an Infrastructure-as-a-Service (IaaS) platform developed and operated entirely by SAP and based on open-source technologies. It is designed to enable customers to achieve digital sovereignty across four dimensions—data, operational, technical, and legal sovereignty.

„The VS-NfD operational authorization confirms its capabilities
and the security of our SAP Cloud Infrastructure, including for
”the most demanding regulatory requirements."

Martin Merz,
President of SAP Sovereign Cloud,
SAP

Sovereign Cloud Region

The foundation is a fully sovereign cloud region within SAP Cloud Infrastructure, featuring three independent availability zones in geographically separate data centers in Walldorf/St. Leon-Rot. This sovereign cloud platform is complemented by a comprehensive security and compliance framework, as evidenced by certifications such as ISO/IEC 27001 based on IT-Grundschutz for the data centers, EN 50600/ISO/IEC 22237, as well as TSI Level 3+ and C5 Type II.

In addition, SAP Cloud Infrastructure has conducted a self-assessment based on the BSI’s C3A (Criteria Enabling Cloud Computing Autonomy) criteria catalog, which confirms compliance with all digital sovereignty requirements. The VS-NfD authorization complements this approach by providing a key component for security-critical use cases with the most stringent requirements.

SAP Cloud Infrastructure, as an operating option for SAP Sovereign Cloud, is an integral part of SAP’s portfolio for digital sovereignty. Together with SAP Sovereign Cloud On-Site and Delos Cloud, SAP thus offers freedom of choice, control, and robust security for customers with stringent regulatory requirements. (Source: SAP)