SAP Security and GRC, 2027 to 2030
Mainstream maintenance ends in 2027. Decide once, with the dates in front of you.
ECC, GRC and identity each have their own end date and their own price for waiting. We lay out your versions, your options and what each one costs. You leave with a decision memo, and a security plan for every year you stay.
Starts with a half-day briefing for your CIO, CISO and controller. The assessment that follows is fixed scope and ends with a decision memo.
The deadline is a ladder. Drag through the years.
SAP's published datesSupported as normal 6
- S/4HANA
- ECC 6.0 on EHP 6 to 8
- SAP GRC Access Control 12.0
- SAP Identity Management 8.0
- Database fixes and kernel security patches on a third-party database
- System conversion to S/4HANA from a third-party database
Supported, costs more 0
Reach us before you pay for extended maintenance. A 20-minute call.
Ended or limited 1
- ECC 6.0 on EHP 0 to 5
Sources: SAP News, 4 Feb 2020 and 7 Oct 2026; SAP Note 1648480; SAP Community for GRC 12.0. Your contract may differ.
The problem
2027 is a ladder, not a cliff. Most plans show only one rung.
Each product has its own date
ECC, Identity Management and GRC do not end together, and older ECC versions are already past theirs.
Waiting has a price
Extended maintenance runs to the end of 2030 and costs more each year you use it.
2030 is the harder date
After it, ECC on a third-party database loses database fixes, kernel security patches and the conversion route to S/4HANA.
Security does not pause while you decide
SAP flaws are on the US government's list of actively exploited vulnerabilities. Staying longer means defending longer.
2027 does not force your move. It puts a price on your delay.
What we do
Check, price, compare, decide. Then secure each year you stay.
- Step 01 of 4
Check your versions
Your exact ECC, GRC and Identity Management versions, and the date that applies to each.
- Step 02 of 4
Price each path
Extend, move now, or move with your S/4HANA program. The cost of each, side by side.
- Step 03 of 4
Compare the routes
The options for GRC and for identity after the move, with what each one covers.
- Step 04 of 4
Decide, and secure the gap
A decision memo, plus what your security looks like in every year before the move.
Step 1 of 4
What you get
Six documents that turn a deadline into a decision.
Tap a document to see what's inside.
- ECC enhancement package level
- GRC and Identity Management versions
- What depends on what
- What extended maintenance adds
- What moving now costs
- What moving with S/4HANA saves
- What each option covers
- What each leaves to you
- Which fit your landscape
- Controls that earn their keep
- Rules and roles to retire
- A fix-first list
- Patch and access priorities by year
- What changes at the end of 2030
- Who owns each control
- The recommended path
- What it costs and when
- The risks you accept by choosing it
How it fits
SAP sells you the destination. We help you decide.
Everyone around you has a stake in which path you pick. We do not resell software or migration work.
SAP gives you
Dates and a price list
- End-of-maintenance dates
- Extended maintenance terms
- Cloud offers tied to a commitment
Your integrator gives you
A migration plan
- Scope, timeline and cost for the move
- Usually without GRC or identity in it
- An incentive to start soon
We give you
An independent decision on access, GRC and identity
- Your real dates, not the headline
- All three paths priced
- Security for the years you stay
- A memo your CFO can sign
Who this is for
You run ECC, and 2027 is on someone's slide.
- You will still be on ECC after 2027.
- You run SAP GRC Access Control or SAP Identity Management.
- Your S/4HANA program is starting and access is not in its plan.
- Your auditors ask what happens to your controls after 2027.
How to start
How to start
- 01
2027 decision briefing
Half a day with your CIO, CISO and controller. The real dates and what they mean for you.
- 02
Decision assessment
Fixed scope. Ends with the six documents and the decision memo.
- 03
Carry it out
The S/4HANA access move, the IDM exit, or the monthly Security Run.
Questions
What people ask before the first call.
Does 2027 mean we must move to S/4HANA?
No. Extended maintenance runs to the end of 2030. It costs more, and 2030 brings harder limits, so the choice deserves real numbers.
What does extended maintenance cost?
SAP's published terms add two percentage points to your maintenance base. Your own contract decides the final figure and any conditions.
Is SAP GRC Access Control 12.0 affected?
Yes. Mainstream maintenance for Access Control 12.0 ends on 31 Dec 2027, with extended maintenance through 2030. SAP's successor is SAP GRC for HANA.
Do you resell software?
No. Where our own tool GRCIQ helps, we say it is ours.
Go deeper
Our research behind this page.
What does each year of waiting cost you?
If nobody has put a number on it, start with the briefing. Half a day, the real dates, and the questions your board will ask.
Or write to support@ux4tech.com
Insights and Architecture Briefs
