Change & Release

In late April 2026, official SAP CAP npm packages were compromised. The attack targets the development toolchain before the first transport. Analysis of the incident, the control points, and the consequences for change governance.

NIS2 is the EU directive on cybersecurity. Transposed into German law via the BSIG. BSI audit phase active since May 2026; personal liability for management effective since December 2025.

Triple compliance in May 2026 refers to the simultaneous applicability of NIS2, DORA, and the EU AI Act. The three regulatory frameworks consume the same operational evidence: audit trail, incident reporting, supply chain inventory, human oversight, and training. An integrated architecture reduces effort and closes gaps.

Four regulations, four retention periods, four reporting logics: How to design an audit logging architecture that satisfies all of them simultaneously without storing logs four times.

A technical assessment of the landscape between standard solutions, community tools, and an impending toolchain gap

An audit trail in the SAP change process is the end-to-end, audit-proof recording of all activities related to a change.

SOX Section 404 requires a verifiable internal control system for changes to financial SAP systems.

Test automation and impact analysis in SAP environments must be considered together to reach their full potential.

Change management in SAP encompasses all changes to code, customizing, and configuration. It does not end with the transport.

Transport management controls the path of changes from the development system to production. Three classes of errors dominate daily operations.

Release governance manages the transition from individual changes to coordinated, controlled production cycles.

An analytical lens for SAP Change Governance: five layers with distinct tasks and decision-making rights, and why ALM is not the same as governance.