# SAP Go-Live Security Readiness Checklist

> Source: https://netray.co/tools/sap-go-live-security-readiness-checklist
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A checklist of security and Basis items to confirm before an SAP system or release goes live, with critical items flagged.

## Category

sap

## Erp

SAP S/4HANA

## Audience

- SAP Basis admin
- Project manager
- GRC analyst

## Tool

**Kind:** checklist

**Groups:**

#### Users and roles

**Items:**

**Text:** Standard users reviewed: default passwords changed for SAP*, DDIC and other delivered users in every client

**Critical:** true

**Text:** SAP* protected against automatic creation (login/no_automatic_user_sapstar set per policy)

**Critical:** true

**Text:** Project and consultant users removed or locked, except those with a documented end date

**Critical:** true

Roles tested in the quality system by business users with a role-only test ID

**Text:** Access risk analysis run on all roles and users, with remaining conflicts in the mitigating control register

**Critical:** true

**Text:** Broad authorizations such as full access profiles absent from production users

**Critical:** true

Emergency access procedure and firefighter IDs ready and tested

User lifecycle process agreed for joiners, movers and leavers

#### System configuration

**Items:**

**Text:** Password and lockout parameters set to policy and logged in the change log

**Critical:** true

Idle session timeout configured

**Text:** Client settings checked: production client set to not allow direct changes

**Critical:** true

Security Audit Log configured with the agreed event classes and retention

Kernel and support package levels documented and agreed with project

Relevant SAP security notes reviewed and applied or risk-accepted

Table logging and change document settings confirmed for critical tables

#### Interfaces and connectivity

**Items:**

**Text:** RFC destinations reviewed: stored credentials justified, no unneeded trusted connections

**Critical:** true

Technical users for interfaces use system or communication type with minimal authorizations

Unused ICF services deactivated

TLS configured on external HTTP and RFC connections where supported

Gateway and message server access restrictions defined

Firewall rules reviewed for SAP ports and external interfaces

#### Operations and recovery

**Items:**

**Text:** Backup taken before cutover and a restore tested in the last quarter

**Critical:** true

Transport route confirmed and no open development transports pending for go-live

Monitoring and alerting configured for system, database and jobs

Background job schedule and job owners reviewed

Hypercare support roles and contact list published

**Text:** Rollback criteria and decision owner agreed

**Critical:** true

Go-live sign-off from business owner, Basis and security recorded

**Scoring Note:** Every critical item should be complete or have a documented, approved exception before go-live. Treat the remaining items as a readiness percentage and review gaps with the project board.

## Content

**Intro:** Go-live is when temporary project shortcuts become permanent. This checklist covers the security and Basis items that are commonly forgotten in the rush to cutover.

**Sections:**

#### How to use the checklist

**Body:** Work through the groups with the Basis team, the security team and the project manager in the same room. Tick items as evidence is available, not as intentions. Critical items are those that, if missed, create immediate exposure, such as default passwords or project users left active. Export the result and attach it to the go-live decision record.

**Bullets:**

- Tick only items with evidence, such as a screenshot or ticket
- Document exceptions with an owner and an expiry date
- Review again after hypercare ends
- Repeat for each system in the landscape, not just the main one

#### Why these items

**Body:** Default users such as SAP* and DDIC exist in every client and are well-known targets, so their passwords and protection are first on the list. Project users are created with broad access to speed up testing and rarely get removed. Client settings determine whether changes can be made directly in production. Interfaces matter because RFC connections with stored credentials can bypass user-level controls if they are poorly scoped.

#### Reading your result

**Body:** A project with all critical items done and a high share of the rest is ready to proceed. If several critical items are open, delay or reduce scope, because the pressure to fix issues after go-live is low and the risk is highest at the start. Record accepted gaps with an approver so they are not forgotten.

#### Common mistakes

**Body:** Teams often review production but forget the sandbox or quality systems with copied data, keep consultant users because they are needed for hypercare with no end date, and run the access risk analysis before the final role changes. Another is relying on a backup that was never restored.

**Cta:** If you want your go-live checks automated against live SAP data, Netray can build read-only checks that run on-prem.

**Faq:**

#### Is this checklist specific to S/4HANA?

**Answer:** The items apply to ECC and S/4HANA alike. Exact transactions and Fiori apps differ by release, so adapt the evidence you collect to your version.

#### Who owns the checklist?

**Answer:** Usually the Basis lead and security lead jointly, with the project manager accountable for the go-live decision. Each item should still name an owner.

#### Can we go live with open critical items?

**Answer:** Only with a documented exception approved by the business owner and IT security, with a fixed date to close. Otherwise treat them as blockers.

#### How is this different from a technical cutover plan?

**Answer:** A cutover plan sequences activities such as data load and transports. This checklist confirms that the security and operational controls are in place around those activities.

## Search terms

sap go live security checklist, sap go live readiness checklist, sap cutover security checklist, sap basis go live checklist, s4hana go live security, sap pre go live audit checklist, sap production readiness checklist

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json