SAP Go-Live Security Readiness Checklist
Go-live is when temporary project shortcuts become permanent. This checklist covers the security and Basis items that are commonly forgotten in the rush to cutover.
0 of 28 items complete
10 critical items still open - these are the highest-risk gaps.
Users and roles
System configuration
Interfaces and connectivity
Operations and recovery
Every critical item should be complete or have a documented, approved exception before go-live. Treat the remaining items as a readiness percentage and review gaps with the project board.
Automate your go-live checks
Optional: we can discuss read-only checks of users, parameters and RFC destinations before cutover.
Optional. The tool and every export work without this. No spam.
How to use the checklist
Work through the groups with the Basis team, the security team and the project manager in the same room. Tick items as evidence is available, not as intentions. Critical items are those that, if missed, create immediate exposure, such as default passwords or project users left active. Export the result and attach it to the go-live decision record.
- Tick only items with evidence, such as a screenshot or ticket
- Document exceptions with an owner and an expiry date
- Review again after hypercare ends
- Repeat for each system in the landscape, not just the main one
Why these items
Default users such as SAP* and DDIC exist in every client and are well-known targets, so their passwords and protection are first on the list. Project users are created with broad access to speed up testing and rarely get removed. Client settings determine whether changes can be made directly in production. Interfaces matter because RFC connections with stored credentials can bypass user-level controls if they are poorly scoped.
Reading your result
A project with all critical items done and a high share of the rest is ready to proceed. If several critical items are open, delay or reduce scope, because the pressure to fix issues after go-live is low and the risk is highest at the start. Record accepted gaps with an approver so they are not forgotten.
Common mistakes
Teams often review production but forget the sandbox or quality systems with copied data, keep consultant users because they are needed for hypercare with no end date, and run the access risk analysis before the final role changes. Another is relying on a backup that was never restored.
Frequently Asked Questions
Is this checklist specific to S/4HANA?
The items apply to ECC and S/4HANA alike. Exact transactions and Fiori apps differ by release, so adapt the evidence you collect to your version.
Who owns the checklist?
Usually the Basis lead and security lead jointly, with the project manager accountable for the go-live decision. Each item should still name an owner.
Can we go live with open critical items?
Only with a documented exception approved by the business owner and IT security, with a fixed date to close. Otherwise treat them as blockers.
How is this different from a technical cutover plan?
A cutover plan sequences activities such as data load and transports. This checklist confirms that the security and operational controls are in place around those activities.
If you want your go-live checks automated against live SAP data, Netray can build read-only checks that run on-prem.
Related Tools
SAP System Landscape Inventory Worksheet
An editable inventory of your SAP systems and clients: SID, tier, release, database, owner and patch dates. Exports to Excel.
SAPSAP Profile Parameter Change Log Worksheet
An editable log of SAP profile parameter changes with old and new values, reason, approver and restart requirement.
SAPSAP Role Change Request Form Template
A fill-in change request for adding or removing authorizations in an SAP role, with SoD check and test evidence sections.
SAPSAP SoD Mitigating Control Register Worksheet
An editable register of accepted SoD conflicts and the compensating controls behind them, with risk score and review dates. Exports to Excel.