APP-10

Control Description

Data backup is performed on a periodic basis.

Risk

Loss of financial data or inability to recover audit trails in a timely manner may prevent transaction substantiation, fraud detection, and regulatory compliance.

Implementation Details

Implementation Approaches for Backup & Restoration

1- Native SAP HANA Tools (SAP HANA Studio / Cockpit / CLI):

• Organizations often use native HANA mechanisms, scheduling database and log backups directly via SAP HANA Studio, SAP HANA Cockpit, or automated command-line scripts (hdbsql or hdbbackupdiag). These backups are written directly to file systems or local Network Attached Storage (NAS) / Storage Area Networks (SAN).

Enterprise Backup & Data Management Platforms (e.g., Rubrik, Cohesity, Commvault, Veeam):

• Many modern enterprises leverage third-party enterprise backup solutions like Rubrik or Commvault. These platforms integrate with SAP HANA via the Backint for SAP HANA API. Instead of writing raw files to disk manually, the native HANA backup stream is directly intercepted and managed by the enterprise backup software, providing deduplication, encryption, policy-based retention, and cloud-tiering capabilities.

Cloud-Native Snapshot and Storage Integration:

• For SAP S/4HANA running on hyperscalers (AWS, Azure, Google Cloud), companies frequently utilize cloud-native infrastructure backups (e.g., AWS EBS snapshots, Azure Backup for SAP HANA, or GCP persistent disk snapshots) combined with SAP-certified agent frameworks to handle consistent database states

Implementation Details for Documentation
• Backup Schedule: Automated periodic backups are configured, typically consisting of full data backups (e.g., weekly or daily), incremental/differential backups, and continuous database log backups (enabling point-in-time recovery).

Storage & Retention:
• Backups are written to secure, isolated storage repositories with defined retention periods in compliance with corporate data governance and financial audit requirements.

• Restoration Testing: Periodic (at least annual) restoration drills are executed where backup images are restored to a non-production or isolated sandbox environment. The data integrity and transaction audit logs are validated, and formal test results/sign-offs are reviewed and retained by IT management.

Test Procedures

Test of Design (ToD):
• Inquire of IT infrastructure and database administration management to understand the backup architecture, scheduling frequency, tool configuration (e.g., Backint integrations), and retention policies.

Test of Operating Effectiveness (ToE):
• Inspect system logs, backup management console records, or job scheduler histories (e.g., HANA backup catalog or Rubrik/Backint dashboards) for a selected sample period to verify that scheduled full, incremental, and log backups completed successfully without error