3266124 - SAP Security, Backup and Disaster Recovery Policy in SAP Business ByDesign

This document provides information about the SAP Security, Backup, and Disaster Recovery Policy in the SAP Business ByDesign system.

SAP Business ByDesign

BACKUP SERVICES

The backup services for SAP Business ByDesign provide regular data and archive log backups. The backups are stored in offsite disk and commercially reasonable efforts to restore productive tenants from backups as soon as practicable in case of a disaster resulting in loss of the production data center. The backup services are included in the subscription and provide the following:

Operational Characteristics

1. Restoration is not a service available on request for customers. It is only available in an emergency situation to mitigate risks from logical errors such as data corruption and other irreparable situations. We recommend that customers request for tenant restore points before important events like data migration, change projects etc., so that a reset to a last good state can be made available quickly.
2. Backup is performed with the following frequency:
   1. Every day database backup (Monday-Sunday); twice per week with interval of 3 days we take full backup, on other days of the week, we take a differential backup.
   2. Backup will be retained for 2 weeks in the primary datacenter and for another 2 weeks in the remote datacenter.
   3. Log file backup every 30 minutes
3. SAP performs daily backup replication to a remote datacenter within the same region.
4. These data backups can be restored in the primary datacenter.
5. Appropriate processes and automated tools are in place to validate backup integrity, and backup logs are reviewed daily to detect and correct backup failures.
6. Backup cycles of the productive and non-productive systems are stored for 28 and 14 days respectively.
7. We are able to restore data to any point in time within the backup cycle.

FAQ

1. What is the backup scheduled for SAP Business ByDesign?

Answer:  Every day database backup (Monday-Sunday); twice per week with interval of 3 days we take full backup, on other days of the week, We take a differential backup. Also on customer request we create restore point and can be rolled back to the restore point when required. The rollback option is only for 14 days from the day of restore point creation. After 14 days the restore point will be automatically deleted.

2. What are other ways can customer request for the Backup of their individual systems?

Answer: Customer can use the Service operations request which is available for the customer called, Restore Point. For more information, refer to the following Knowledge Base Articles:
KBA 2315326 - How to Request a Restore Point 
KBA 2653007 - How to Terminate Restore Point? 
KBA 2560598 - How to Request Restore/Rollback to Restore Point? 

3. The 'Point in time,' is it limited to retrieving data alone from the previous daily backup, or does it offer the capability to recover to a more recent point in time, considering that logs are backed up every 30 minutes?

Answer: To recover data from a specific time or from where it was last saved, we need the latest complete data backup and backups of the logs. If there's a disaster, we'll restore the system using the newest complete data backup along with the log backups up to the point of the disaster.

4. When a backup is performed are there anything excluded from recovery or is all data restored, including the temporary logs?

Answer: All data is recovered up to the point in time when the recovery is performed, including temporary logs. 

5. Is recovery possible for data from as recently as 24 hours ago? What is the minimum timeframe for which data recovery is possible?

Answer: Backups are retained for up to 14 days in a geographically separated backup data center, and recovery can be performed within this retention period based on the available backups. 

6. Explain the mechanism for recovery to a state as far back as possible using differential backups and log backups performed between full backups.

Answer: Recovery is possible by restoring the latest completed full backup, followed by applying the corresponding differential backups and log backups in sequence to reach the desired point in time. 

7. Specify the granularity of restoration from backups. Is it possible to restore only a specific piece of data to past state, or does it require restoring the whole system to a past point in time?

Answer: Restoration is possible only by restoring the entire system to a past point in time; restoring individual pieces of data is not supported. 

8. Does SAP Business ByDesign have ransomware countermeasures in place? Is Immutable Protection (which prevents deletion or modification of written backups for a set period) functioning?

Answer: SAP Business ByDesign have retention lock immutability enabled for backups. 

9. If data is lost or corrupted due to an incident occurring on a customer's User PC (such as data encryption by ransomware or unauthorized access), it would also be restored from backup?

Answer: In the event of data loss or corruption in SAP Business ByDesign, data restoration from backup is possible.
Recovery can be performed up to the latest possible point in time (including log file replay) within the database recovery process, based on the customer’s requested recovery timeframe. Please note that the exact recovery outcome depends on the nature and scope of the incident.

    

Blog: SAP Business ByDesign Backup

Help Portal Document: Security Guide for SAP Business ByDesign

Further for the SOC1 Reports and Log files, refer the Knowledge Base Article: KBA 2681625 - How to Get SOC1, SOC2 or ISO 27001 Reports for Audits

SAP Trust Center Links related to Security, Data Protection & Data Centers:

My Trust Center

Security

Data Protection and Privacy

Data Centers

Backup, Data Center, Data Protection, My Trust Center, Cloud Operations, Disaster Recovery Management, byd backup, data center,disaster recovery management,restore point , KBA , SRD-CC-CI-CCS , ByD Service Control Center , How To