# SAP Security Incident Report Template

> Source: https://netray.co/tools/sap-security-incident-report-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A structured incident report for suspicious SAP activity such as misused accounts, unexpected RFC calls or unauthorized changes.

## Category

sap

## Erp

SAP ECC / S/4HANA

## Audience

- SAP Basis admin
- Security analyst
- IT manager

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### Incident number

**Key:** inc_no

**Type:** text

**Default:** SEC-2026-0027

#### Date detected

**Key:** detected

**Type:** date

**Default:** 2026-10-18

#### Reported by

**Key:** reporter

**Type:** text

**Default:** N. Okafor, SAP Basis

#### Severity

**Key:** severity

**Type:** select

**Options:**

- Low
- Medium
- High
- Critical

**Default:** High

#### Systems and clients affected

**Key:** systems

**Type:** text

**Default:** PRD client 100, connected CRM system

#### User IDs involved

**Key:** users

**Type:** text

**Default:** TEMP_CONSULT3 (dialog), RFC_INTF01 (system)

#### What was observed

**Key:** summary

**Type:** textarea

**Default:** Audit log showed repeated failed logons for a dialog user followed by a successful logon from an unfamiliar network range, then a call to user maintenance. The user holds a consultant role that should have expired.

#### Evidence collected

**Key:** evidence

**Type:** textarea

**Default:** Security audit log extract, system log entries, change documents for user master records, list of active sessions at time of detection.

#### Containment actions

**Key:** containment

**Type:** textarea

**Default:** User locked, active sessions ended, password reset on related interface user, firewall rule added for the source range.

**Blocks:**

#### SAP Security Incident Report {{inc_no}}

**Body:** Company: {{company}}
Date detected: {{detected}}
Reported by: {{reporter}}
Severity: {{severity}}
Systems affected: {{systems}}
User IDs involved: {{users}}

#### Summary of observation

**Body:** {{summary}}

#### Evidence collected

**Body:** {{evidence}}

#### Containment actions

**Body:** {{containment}}

#### Timeline

**Table:**

**Columns:**

- Date and time
- Event
- Source
- Owner

**Rows:**

**1:** First suspicious event

**1:** Detection

**1:** Containment

**1:** Recovery

#### Impact assessment

**Table:**

**Columns:**

- Question
- Answer

**Rows:**

**0:** Was data viewed, changed or exported?

**0:** Were master data or financial postings changed?

**0:** Are other systems or interfaces exposed?

**0:** Is notification to legal, customers or regulators required?

#### Root cause and corrective actions

**Table:**

**Columns:**

- Finding
- Corrective action
- Owner
- Due date

**Rows:**

#### Sign-off

**Signatures:**

- Incident handler
- IT security manager
- Business owner

**Notes:** Follow your own incident response plan and legal obligations on notification. This template documents facts and actions; it is a starting point, not legal advice.

## Content

**Intro:** When something odd shows up in an SAP system, the first hour is spent remembering what to record. This report gives you a fixed structure for facts, evidence, containment and follow-up.

**Sections:**

#### How to use the report

**Body:** Open it as soon as the incident is declared and fill in what you know. Add the timeline as evidence arrives, and keep the facts separate from assumptions. The report is meant to be updated, so export a version at each major step. At closure, record root cause, corrective actions and owners.

**Bullets:**

- Record dates and times with time zone
- Name the source of each event, for example audit log or system log
- Separate containment from recovery
- Assign an owner and due date to every corrective action

#### Where SAP evidence lives

**Body:** Useful sources include the Security Audit Log (configured in SM19 and read in SM20), the system log (SM21), change documents for user master records (SUIM reports), RFC and gateway logs, and the ICM and web dispatcher logs for HTTP access. Which events are recorded depends on how the audit log was configured, so verify that before an incident, not during it. Preserve exports before logs roll over.

#### Containment choices

**Body:** Typical containment steps are locking the user, ending sessions, rotating passwords for related technical users, restricting network access and disabling a vulnerable service. Each step affects the business, so record who approved it. Interface users in particular can stop integrations when locked, so check dependencies first.

#### Common mistakes

**Body:** Teams often change evidence by cleaning up too early, skip the impact questions, or close the incident with no corrective action on the weakness that allowed it. Expired consultant accounts, shared technical users and forgotten test clients are recurring root causes.

**Cta:** If you want SAP audit log and user activity searchable by plain question without sending data off site, Netray builds that on-prem, read-only by default.

**Faq:**

#### Is this a replacement for an incident response plan?

**Answer:** No. It is the documentation form that sits inside your plan. Roles, escalation paths and notification duties should come from your own plan and legal advice.

#### What if the audit log was not enabled?

**Answer:** Record that as a finding. Use the system log, change documents, database and network logs as fallback evidence, and add audit log configuration to the corrective actions.

#### Who should sign the report?

**Answer:** The person who handled the incident, the IT security owner, and the business owner of the affected process. Add legal or data protection if personal data may be involved.

#### Should I lock the user immediately?

**Answer:** Usually yes for a compromised dialog user, but check whether it is a technical or interface user first. Locking those can halt integrations, so coordinate with the interface owner and record the decision.

## Search terms

sap security incident report template, sap incident response template, sap suspicious activity report, sap unauthorized access incident form, sap audit log incident report, sap breach report template, sap security event documentation

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json