NIS2 Compliance for SAP Solutions

⇨ The NIS2 Directive, effective October 17, imposes stringent cybersecurity and incident reporting requirements on organizations within the EU, particularly targeting essential and important sectors of critical infrastructure.

⇨ Organizations managing SAP solutions must implement specific security measures including adherence to SAP's security benchmarks, timely incident detection, and effective reporting mechanisms to protect sensitive data and ensure compliance with the Directive.

⇨ Layer Seven Security has released a whitepaper that provides guidance on NIS2 compliance for SAP solutions, detailing hardening standards and threat detection mechanisms to meet the cybersecurity requirements outlined in the Directive.

The Network and Information Security (NIS2) Directive takes effect on October 17 and imposes significant requirements on organizations for cybersecurity and incident reporting. NIS2 mandates strict standards for cybersecurity and incident reporting for organizations that are based in the European Union or provide services within the EU. It is targeted at essential and important organizations in specific sectors considered part of the supply chain for critical infrastructure in member states. The Directive includes requirements for protecting the confidentiality, integrity and availability of data in network and information systems against cyber threats and detecting and reporting significant security incidents within prescribed time frames. This includes data and incidents impacting business-critical SAP solutions.

SAP solutions are some of the most important information systems in organizations, often storing and processing sensitive financial and personal information. Security failures that lead to data breaches, financial fraud or impact the availability of SAP systems can have a significant impact on organizations. The Directive provides specific guidance for organizations managing SAP solutions to protect network and information systems and report significant incidents. For SAP solutions, the measures should include adherence to security benchmarks and SAP recommendations for system hardening, security patching, and securing custom code. SAP recommendations are documented in security guides and standards for each area and product. The measures should also include mechanisms for the timely detection, investigation and reporting of security incidents captured in SAP logs. Pattern matching and anomaly detection can be deployed to detect security incidents efficiently and effectively in SAP solutions.

The Cybersecurity Extension for SAP simplifies the path to NIS2 compliance. The SAP-certified solution automates vulnerability detection, compliance reporting, and custom code security to reduce the complexity and lower the cost of compliance with Article 21 of the Directive. The solution also enables organizations to meet the requirements of Article 23 for breach identification and reporting through automated threat detection and incident response for SAP applications. SAP customers are responsible for securing and monitoring the application layer within SAP solutions. This includes customers using SAP solutions managed directly by SAP as part of SAP RISE. Standard RISE services do not delegate responsibility for securing applications from customers to SAP.

Layer Seven Security‘s newly-released whitepaper simplifies the path to NIS2 compliance by providing guidance for complying with the Directive for SAP solutions. This includes sources for hardening standards to comply with cybersecurity requirements, and threat detection and response mechanisms to comply with the incident reporting requirements of the Directive. The guidance includes specific recommendations for solutions in SAP RISE.

Download the whitepaper here.