Topic starter
03/06/2026 2:21 pm
TL;DR: SAP clean core certification for Pathlock’s Native Cyber Security and GRC Suite and Application Profiler highlights a familiar migration risk: carrying technical debt, intrusive customisations, and governance gaps into S/4HANA can weaken auditability and upgradeability, according to Pathlock. For IAM and GRC teams, the issue is not certification itself but whether controls stay enforceable without modifying the digital core.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “Pathlock Solutions Achieve SAP®-Certified for Clean Core with RISE with SAP”.
Key questions
Q: How should security teams govern SAP access during an S/4HANA migration?
A: Security teams should treat migration as a governance redesign exercise, not a lift-and-shift.
Q: What breaks when custom SAP controls are left inside the digital core?
A: Embedded custom controls often become brittle during upgrade and audit cycles.
Q: How can IAM teams tell whether their SAP governance is migration-ready?
A: Migration-ready governance is visible when access rules, approvals, and audit trails are defined in standard extension points and can be tested against the target-state environment.
Practitioner guidance
- Inventory embedded access logic Catalogue custom role logic, approval paths, compensating controls, and transaction-specific exceptions that currently live inside the SAP core.
- Re-test SoD after architecture changes Validate segregation-of-duties rules in the target-state environment rather than assuming source-system controls will behave identically after migration.
- Separate core modifications from governed extensions Move business-specific logic out of the SAP core and into controlled extension patterns with documented ownership, change controls, and audit trails.
Bottom line: The main risk in S/4HANA migration is not the move itself but carrying forward custom access logic and audit gaps that no longer fit the target architecture.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 2:27 pm
Clean core is now an identity governance problem as much as an ERP architecture problem. The article is not really about certification as an end state. It is about whether organisations can migrate to S/4HANA without carrying forward access exceptions, audit gaps, and brittle custom controls that were tolerated in legacy ECC environments. That makes the migration a governance redesign exercise, not a lift-and-shift technical project. The practitioner conclusion is straightforward: if the control model cannot survive the new architecture, the migration is not yet ready.
A question worth separating out:
Q: Why do clean core and auditability need to be designed together in SAP programmes?
A: Clean core reduces the risk of hidden customisation, while auditability depends on controls remaining traceable and testable through change. If those two goals are separated, teams can end up with a cleaner architecture that is harder to evidence, or a more evidentiable system that is harder to upgrade. Governance only holds when both are aligned.
👉 Read our full editorial: SAP clean core certification sharpens governance for S/4HANA migration