# SAP Basis Security Hardening Self Assessment > Source: https://netray.co/tools/sap-basis-security-hardening-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer ten questions about your SAP system security basics and get a score with the gaps to close first. ## Category sap ## Erp SAP ECC and S/4HANA ## Audience - SAP Basis admin - SAP security analyst - CISO ## Tool **Kind:** assessment **Questions:** #### How are the standard users SAP* and DDIC protected in every client? **Help:** Check all clients, including 000 and any unused ones. **Options:** ##### Strong passwords, SAP* locked, hardcoded fallback disabled, use monitored **Score:** 3 ##### Passwords changed but use is not monitored **Score:** 2 ##### Changed in the main clients only **Score:** 1 ##### Not reviewed or initial passwords may remain **Score:** 0 #### How strong is the password and logon policy set by profile parameters? **Options:** ##### Length, complexity, lockout and history all set in line with policy **Score:** 3 ##### Length and lockout set, complexity partly **Score:** 2 ##### Mostly defaults **Score:** 1 ##### Unknown **Score:** 0 #### How is the use of SAP_ALL and similar broad profiles controlled? **Options:** ##### Not assigned to anyone except through a logged emergency process **Score:** 3 ##### A few named admins hold it with periodic review **Score:** 2 ##### Assigned to several support or project users **Score:** 1 ##### We do not know who has it **Score:** 0 #### How are RFC connections and the S_RFC authorization check managed? **Options:** ##### RFC destinations reviewed, trusted connections limited, S_RFC enforced and scoped **Score:** 3 ##### S_RFC is enforced but destinations are reviewed rarely **Score:** 2 ##### Broad S_RFC and stored credentials in many destinations **Score:** 1 ##### Not reviewed **Score:** 0 #### How are the gateway and message server access files maintained? **Options:** ##### secinfo, reginfo and ACL files are explicit, restrictive and monitored **Score:** 3 ##### Files exist but contain broad entries **Score:** 2 ##### Files exist but were never reviewed **Score:** 1 ##### Files missing or open access **Score:** 0 #### Is the Security Audit Log active, and who reviews it? **Options:** ##### Active, key events defined, shipped to a SIEM and reviewed **Score:** 3 ##### Active and reviewed on request **Score:** 2 ##### Active but nobody reviews it **Score:** 1 ##### Not active **Score:** 0 #### How current are SAP Security Notes and kernel patches? **Options:** ##### Security notes assessed monthly and applied on a defined schedule **Score:** 3 ##### Applied a few times a year **Score:** 2 ##### Applied only with upgrades **Score:** 1 ##### No process **Score:** 0 #### How do you control development access and changes in production? **Options:** ##### No developer access in production, change protection on, all changes via transports **Score:** 3 ##### Developer access exists but is exception based and logged **Score:** 2 ##### Some direct changes in production happen **Score:** 1 ##### Production is open for changes **Score:** 0 #### How do you protect communication between GUI, servers and external systems? **Options:** ##### SNC or TLS used for GUI, RFC and HTTP with current ciphers **Score:** 3 ##### HTTPS used, but GUI and RFC traffic not encrypted **Score:** 2 ##### Encryption only on external access **Score:** 1 ##### No encryption **Score:** 0 #### How often do you review user access and inactive users? **Options:** ##### At least twice a year with documented sign off and automatic inactivity handling **Score:** 3 ##### Annual review **Score:** 2 ##### Only during audits **Score:** 1 ##### Never done **Score:** 0 **Bands:** #### High exposure **Min:** 0 **Max:** 39 **Verdict:** Several basic controls are missing or unknown. Attackers and auditors usually start with exactly these areas: default users, broad profiles, RFC and gateway access. **Recommendations:** - Secure SAP* and DDIC in every client first - Find all holders of SAP_ALL and remove or control them - Enable the Security Audit Log and decide who reviews it - Review RFC destinations and gateway security files #### Basics partly in place **Min:** 40 **Max:** 64 **Verdict:** You have started on hardening, but gaps remain in monitoring or review. The next gain comes from making controls repeatable and visible. **Recommendations:** - Document the profile parameter baseline and compare all systems to it - Review S_RFC scope and stored RFC credentials - Set a monthly security note review - Introduce a recurring inactive user review #### Solid baseline **Min:** 65 **Max:** 84 **Verdict:** Most core controls are in place. Focus on evidence, automation and the harder topics such as encryption everywhere and emergency access. **Recommendations:** - Automate evidence collection for audits - Extend encryption to all GUI and RFC traffic - Test your emergency access process and review its logs - Ship audit events to a central SIEM #### Mature **Min:** 85 **Max:** 100 **Verdict:** Your basic hardening looks strong. Keep it that way by monitoring drift and testing controls, and consider deeper work on authorization design and SoD. **Recommendations:** - Run periodic drift checks against your baseline - Perform a penetration test or configuration scan - Review segregation of duties rules against current roles ## Content **Intro:** This self assessment checks ten areas that appear in almost every SAP security review. It is not an audit, but it shows quickly where the biggest gaps sit so you can prioritise Basis work. **Sections:** #### How to use the assessment **Body:** Answer based on what you can prove today, not what the policy says. If you do not know, pick the lowest score, because an unknown control is an audit finding either way. Run it once per productive system, since landscapes are rarely hardened evenly. Export the result and keep it with your risk register to show progress over time. **Bullets:** - Answer for one system at a time - Choose the lower score when evidence is missing - Repeat after each hardening round #### What the questions cover **Body:** The questions follow the typical attack and audit path: delivered users, password and logon policy, broad profiles, RFC trust, gateway and message server access, audit logging, patching, change control in production, encryption in transit and access reviews. These are Basis level controls. They do not replace role design, segregation of duties analysis or a GRC rule set, which sit one layer above. #### Reading the result **Body:** The score is the share of the maximum points. Low scores mean basic controls are absent, so fix those before spending effort on advanced topics. Middle scores usually reflect good intentions without repeatability. High scores still deserve periodic drift checks because parameters, roles and RFC destinations change with every project. **Bullets:** - Fix default users and broad profiles first - Then logging and RFC and gateway controls - Then automation and evidence **Cta:** If you want an outside view of your SAP security baseline, we can discuss a review that runs inside your network and keeps all data local. **Faq:** #### Is this assessment a replacement for a security audit? **Answer:** No. It is a quick self check of Basis level controls. A formal audit or penetration test examines configuration, roles and interfaces in far more depth and produces evidence. #### Why do RFC and gateway settings matter so much? **Answer:** They define how systems trust each other and who can start programs or register servers. Misconfiguration there can give broad access without any dialog logon, so they are priority review items. #### How often should I repeat the assessment? **Answer:** At least annually, and after major changes such as upgrades, system copies or new interfaces. Many teams repeat it quarterly while closing gaps. #### Does it cover cloud SAP products? **Answer:** It is written for ABAP based systems you operate yourself. SaaS and cloud editions have a different responsibility split with SAP and need their own checks. ## Search terms sap security assessment, sap hardening checklist, sap basis security review, sap security self assessment, sap security baseline, sap system security audit questions, sap rfc gateway security, sap security health check --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json