Knowledge base / Audit and compliance
Regulations and deadlines
Segregation of duties used to be a SOX topic for listed companies. In the EU it is now part of cybersecurity and operational-resilience law, and SAP's own roadmap is forcing role redesign at the same time.
NIS2 — Directive (EU) 2022/2555
Member states had to apply it from 18 October 2024. Article 21 lists access control policies among the minimum cybersecurity risk-management measures for essential and important entities, and asks them to assess whether those measures are effective. Business applications such as SAP handle the processes the directive cares about, so ERP access is in scope.
DORA — Regulation (EU) 2022/2554
Applies to financial entities since 17 January 2025. Its ICT risk-management rules expect access rights to follow need-to-know and least privilege, and to be reviewed and documented.
SOX and internal control over financial reporting
For companies under SOX or similar regimes, SoD in the financial processes remains a core IT general control. External auditors test the report as well as the result — see Audit evidence.
SAP maintenance dates
| Product | Date | What it means for SoD |
|---|---|---|
| SAP ECC 6 / Business Suite 7 — mainstream maintenance | 31 Dec 2027 (extended maintenance available at extra cost to 2030) | S/4HANA projects rebuild the role catalogue around Fiori and SAP_BR_* business roles. Fix SoD in the design, not after go-live. |
| SAP GRC 12 (Access Control) — maintenance | Planned end 31 Dec 2027 | Teams choose between Access Control on HANA, SAP Cloud Identity Access Governance or a lighter approach. An independent risk baseline helps that decision. |
Dates as published at the time of writing. Check SAP's Maintenance Planning tools and your own maintenance agreement before planning.
Still stuck? Ask us — we answer within one working day.