Security is not static. It follows a cadence.

Operating system and SAP layer,
managed together

Security vulnerabilities do not distinguish between infrastructure and applications. An unpatched operating system is just as much an entry point as an unresolved SAP vulnerability. SK therefore treats both layers as one shared responsibility, not as two separate workstreams with different priorities.

In technical terms, operating system kernels, database patches and SAP kernel patches are considered within the same maintenance window rather than planned in isolation. A restart for a kernel update can therefore be combined with upcoming SAP Support Package activities instead of taking the system out of operation twice in separate maintenance windows only a few days apart.

The foundation beneath
everything else

Every system operated by SK receives the available operating system and database patches each month. These include kernel updates, security-relevant libraries, drivers and, where necessary, database patch sets. This is deliberately not an optional service. It is a fixed part of the operating model, because maintaining the platform beneath an SAP system is part of operating that system.

Deployment follows a defined sequence: first in the development or quality assurance system, with sufficient time for regression testing, before the same patch level reaches production. The required maintenance window is agreed with the customer rather than imposed overnight.

This establishes the foundation for everything else. An SAP system can only be as secure as the operating system on which it runs.

From Security Note
to deployed patch

On the second Tuesday of every month, known as SAP Security Patch Day, SAP publishes its Security Notes. These address vulnerabilities in the application layer, are assessed using the CVSS score and range from minor corrections to SAP HotNews, the most critical category. SK does not deploy these notes directly or without review. They follow a defined process:

Review. Our SAP Basis experts evaluate every new note centrally, once a month for all managed systems rather than separately for each customer. HotNews are the exception: a critical classification interrupts the regular monthly cadence and triggers an out-of-cycle response.

Assess. We determine the relevance and criticality for each system landscape. Which notes affect the components and release levels actually in use? Where does the CVSS score indicate an urgent need for action? Which notes can be monitored without immediate deployment?

Deploy. Patches assessed as relevant are introduced into the system landscape in a controlled manner through the SAP transport system. They are first tested in development and quality assurance, then scheduled for production, documented for traceability and coordinated with ongoing operations rather than deployed as an uncoordinated blind action.

One team reviews,
every customer benefits

The central assessment is the decisive part of this process. On an average Patch Day, SAP publishes several dozen to more than one hundred new notes across all SAP components. Each note is assessed once by our experts, and that knowledge is applied across all affected customer systems. Individual customers do not have to work through the monthly volume of notes on their own.

For a single internal IT team, this is a difficult ongoing responsibility to manage alongside day-to-day operations. For SK, it is exactly the task we are here to perform as a specialized SAP Basis operator: treating security as a continuous, reliable cadence rather than a project. Every deployed patch is documented and remains traceable within our ISO/IEC 27001-certified information security management system. This supports audits and our customers’ own compliance evidence requirements.

How current is your
SAP system, really?

Let’s assess where your SAP Basis operations stand today and which operating model can turn a functioning system landscape into one that is reliably predictable.

Let’s assess your situation together