SAP Transport Security Controls

Why transport security matters

Transport security is the layer that governs how changes move through the SAP landscape. Every change to authorization, configuration, custom code, and master data structure travels through a transport request from development to quality assurance to production. Without disciplined transport security the customer accumulates unreviewed code, unauthorized configuration changes, and segregation of duties violations between developer and basis administrator. The accumulation appears in external audit as a control weakness in the change management process.

This article documents the transport governance model, the code review gate, the authorization model for transport actions, and the audit defensible transport posture. Reference the SAP security audit pillar, the ABAP security analysis, and the GRC and security expertise.

Transport governance model

The transport governance model rests on three controls. The transport request is owned by the developer and tracks the technical content of the change. The release approval is owned by the team lead and signs off that the change is functionally complete. The import approval is owned by the basis administrator and signs off that the production import window is appropriate. The three controls are separated so that no single role can move a change end to end without a peer check.

Reference the change management controls analysis, the role design methodology, and the authorization concepts analysis.

Code review gate

The code review gate is the discipline that inspects custom ABAP code before the transport release. The gate covers authorization checks in custom programs, dynamic open SQL statements that bypass authorization, unsafe use of EXEC SQL and ASSIGN with dynamic offsets, and the absence of authorization checks where standard SAP transactions would enforce them. The customer position is to operate a mandatory code review queue with two reviewer signatures before any transport tagged as containing custom code can release. The discipline is enforced through a release strategy in the transport management system.

Reference the ABAP security analysis, the RFC security analysis, and the basis security analysis.

Two reviewer signatures on every custom code transport is the single most leveraged change management control. The signature discipline converts code quality risk from an open ended exposure into a bounded operating metric.

Authorization model for transport actions

The transport authorization model rests on object S_TRANSPRT. The object controls who can create, release, and import transports. The customer position is to grant transport creation to developers, release approval to team leads, and import authority to basis administrators only. The three authorizations must never collapse onto the same human user. The technical user that runs the import is a separate identity from any human user. Reference the critical SAP authorizations analysis, the license audit pillar (cross cluster reference for the privileged user implication of consolidated transport authority), and the privileged access analysis.

Audit defensible transport posture

The audit defensible transport posture has five components. First, the transport governance model with separated creation, release, and import authority. Second, the code review gate with two reviewer signatures for custom code transports. Third, the transport authorization model that prevents end to end control by a single human user. Fourth, the transport log retention that supports external audit walkthrough for 12 to 24 months depending on the SoX scoping. Fifth, the emergency transport process that bypasses the queue with documented justification and post hoc review within five business days. The five components together survive external auditor walkthrough and SoX testing.

The implementation detail is in our GRC implementation analysis, the table logging configuration, the SoX ITGC analysis, and the compliance framework pillar. The SoX compliance expertise documents the full senior advisor methodology.