Compliance · NIS2 · DORA
NIS2 and DORA on SAP systems: what can be checked, and how
The NIS2 directive and the DORA regulation require security measures you can demonstrate. On SAP systems part of those measures is technical and can be read from the system: SUPtime checks it and turns it into a report to sign.
Check by check
Six checks, each with its regulation
The article mapping is the one printed in the report, verified against the texts of NIS2, of the Italian ACN determination 164179/2025 and of DORA. It supports an assessment; it is not legal advice.
| Check | Source | NIS2 art. 21 | ACN | DORA |
|---|---|---|---|---|
| Profile parameters | TH_GET_PARAMETER | (2)(i) access control policies | PR.PS-01 secure baseline configurations | art. 9(4)(c) logical access restriction |
| Standard users | USR02 | (2)(i) access control policies | PR.AA-01 inventoried, individual accounts · PR.AA-05 least privilege | art. 9(4)(c) logical access restriction · art. 9(4)(d) strong authentication |
| Client modifiability | T000 | (2)(e) security in development and maintenance | PR.PS-01 secure baseline configurations | art. 9(4)(e) ICT change management |
| Security Audit Log | RSAUPROF · RSAU_READ_LOG | (2)(b) incident handling | PR.PS-04 logs of remote and administrative access | art. 10 detection of anomalous activities |
| Certificates | SSFR_GET_CERTIFICATELIST | (2)(h) cryptography and encryption | PR.DS-02 encryption of data in transit | art. 9(3)(a) security of data transfer means |
| Kernel age | TH_SAPREL2 | (2)(e) vulnerability handling | PR.PS-02 security updates without undue delay · ID.RA-01 vulnerabilities recorded | art. 9(4)(f) patches and updates |
Profile parameters no longer share a single label: each carries its own references, because passwords are about access control and SNC is about encryption. A kernel older than twelve months is a WARN, not a FAIL: it points at missing patches, it does not prove any are missing. Twelve months is the default of KERNEL_MAX_AGE_MONTHS and is set per installation; it is the same threshold the BASIS tab uses, so the tab and the report cannot disagree.
Profile parameters
The values compared with the SAP Security Baseline
Read with TH_GET_PARAMETER: these are the active values, not the ones written in the profiles. The regulations do not set these numbers — NIS2, ACN and DORA ask for measures proportionate to the risk and documented, without values: they come from the SAP Security Baseline, used as a secure reference configuration, and are set per installation, because a value acceptable in development is not in production.
| Parameter | Expected value | What it protects |
|---|---|---|
| login/min_password_lng | at least 8 | Minimum password length |
| login/min_password_digits | at least 1 | At least one digit in the password |
| login/min_password_letters | at least 1 | At least one letter in the password |
| login/min_password_specials | at least 1 | At least one special character |
| login/password_history_size | at least 5 | Previous passwords that cannot be reused |
| login/password_expiration_time | 1 to 183 | Expiry in days: 0 means never, and beyond 183 it effectively never expires |
| login/password_compliance_to_current_policy | 1 | A password that does not meet the current policy must be changed at logon |
| login/password_downwards_compatibility | 0 | No old, weak hash kept alongside the current one |
| login/fails_to_user_lock | 1 to 5 | Failed attempts before the user is locked |
| rdisp/gui_auto_logout | 1 to 3600 seconds | SAP GUI logout after inactivity; accepts SAP units (30M, 1H) |
| login/no_automatic_user_sapstar | 1 | Disables the kernel's implicit SAP* user |
| snc/enable | 1 | SNC encryption of communications |
| system/secure_communication | ON | Encrypted communication between SAP components |
| auth/rfc_authority_check | at least 1 | Authorization check on RFC calls (S_RFC) |
| rfc/callback_security_method | 3 | RFC callbacks accepted only from an allowlist |
| gw/reg_info | set | Gateway reginfo file |
| gw/sec_info | set | Gateway secinfo file |
| gw/acl_mode | 1 | Gateway in restrictive ACL mode |
| rsau/enable | 1 | Security Audit Log enabled |
| icm/HTTPS/verify_client | at least 1 | Client certificate verification on HTTPS |
The report
A document to sign, tied to the data it read
Signature line
A cover page with the score summary and room for the signatory.
SHA-256 hash of the run
It ties the signature to precise data: if the data changes, so does the hash.
Remediation and references
For each check: outcome, value found, expected value, remediation and the NIS2 and DORA articles.
Raw evidence
An appendix with the data as it came from the system, for whoever needs to verify it.
Outcomes
PASS, FAIL and UNKNOWN
Data that was not read is not compliant data.
PASS
The value read meets the threshold.
FAIL
The value read does not meet it, and the report gives the remediation.
UNKNOWN
The data could not be read, because of a missing authorization or a missing source. It stays out of the score and the report says so.
How it is used
Switched on when you need it
Off by default
It queries production systems, so it is switched on deliberately from Settings.
Daily run
Every run is kept in the history, with its outcomes.
Traced
Every run and every report download goes into the hash-chained audit trail.
FAQ
NIS2, DORA and SAP
Does SUPtime make an SAP system NIS2 compliant?
No. It checks the technical part of the measures that can be read from the SAP system and produces the evidence. Compliance remains the assessment of whoever is responsible for it.
Which NIS2 checks does it run on SAP systems?
Profile security parameters against the SAP Security Baseline, unlocked standard users, modifiable production clients, certificate expiry and an active Security Audit Log.
Does the report also cover DORA?
Every check also lists the matching DORA articles, art. 9 and art. 10. It is the same document.
Does the law say passwords must be eight characters?
No, and none of the three says so. NIS2, the Italian ACN determination 164179 of 2025 and DORA ask for measures proportionate to the risk and documented, without setting a single numeric value. The eight characters, the five attempts and the hundred-and-eighty-three days come from the SAP Security Baseline, which SUPtime uses as a secure reference configuration (ACN PR.PS-01) and which has to be adapted to the organisation's own risk assessment. The report says so, rather than passing a number from SAP off as a legal requirement.
What happens if the user is missing an authorization?
The check comes out UNKNOWN, stays out of the score, and the report states how many checks it could not verify.
What format is the report?
Word (DOCX), with a signature line and the SHA-256 hash of the run. The signatory can edit the text; a PDF is one "Save as" away.
Declared limits
What it does not do
NIS2 and DORA are much broader than technical checks on SAP.
- It does not certify compliance and does not replace the assessment of whoever is responsible for it.
- It does not cover organizational measures: governance, supplier management, training, continuity plans.
- The standard users check only sees the client of the connection: covering all of them needs one user per client.
- RSAUPROF event classes and severity go into the evidence, but are not interpreted.
Need a NIS2 report on your SAP systems?
We will show you the report on a real system and what the user needs to read the data.