Join our Newsletter — 33% off our NHI Course
Home FAQ Cyber Security How should organisations plan an SAP S/4HANA migration…
Cyber Security

How should organisations plan an SAP S/4HANA migration when the deadline is approaching but the target state is still undecided?

← Back to all FAQ
By NHI Mgmt Group Editorial Team Updated September 19, 2026 Domain: Cyber Security

Start planning early and treat migration as a governance programme, not just a technical upgrade. Early work gives teams time to assess current processes, identify dependencies, compare greenfield, brownfield, and hybrid options, and align the migration path with business goals. That sequencing reduces avoidable disruption and makes it easier to balance cost, flexibility, and operational continuity.

How to plan the migration when the target state is not yet fixed

The practical move is to separate decision-making from execution, then keep both moving in parallel. Lock down the facts that will shape the programme, current customisations, integrations, reporting dependencies, data quality, and release constraints, while a small set of stakeholders evaluates the migration options. That avoids wasting time on a premature design, but it also prevents deadline pressure from turning into avoidable rework later.

A useful way to think about the work is as option narrowing. Greenfield, brownfield, and hybrid approaches each carry different trade-offs for standardisation, technical debt, test effort, and business disruption, so the aim is not to guess the winner early. It is to define the criteria that will decide it, then use them to compare the options against the actual operating model the business needs.

For SAP programmes, this usually means creating a decision backlog rather than a single binary decision gate. You need enough architectural and process detail to understand what must be preserved, what can be simplified, and what can be redesigned, while also keeping the schedule visible so the unresolved target state does not drift into a last-minute crisis. The migration plan should therefore include option-dependent workstreams, with clear points where the team can commit or pivot.

What the evaluation work should cover before the path is chosen

The evaluation should focus on process fit, data migration complexity, and the operational consequences of each route. If the organisation has many unique processes, heavy custom development, or fragile downstream integrations, the cost of a full reimplementation will be different from an incremental conversion. If the business wants to standardise and simplify, a greenfield-style reset may be attractive even if it requires more process change management.

Dependency mapping matters because the technical path is only part of the real risk. Finance, procurement, supply chain, and reporting often depend on adjacent systems, user roles, interfaces, and cutover windows that are easy to underestimate. A migration strategy is stronger when it shows which dependencies are fixed, which can be retired, and which require temporary coexistence while the target design is still being finalised.

The other key issue is timing discipline. When deadlines approach, organisations often over-commit to implementation activity before they have decided what should be carried forward. That can lock in technical debt, make testing less meaningful, and raise the chance of expensive redesign late in the programme. Early discovery work should therefore be treated as a risk-reduction phase, not as delay.

Risk and Threat Considerations

The main risk is not choosing the wrong migration style in the abstract, it is entering build and cutover planning before the target state is clear. That creates rework, increases the chance of overlooked dependencies, and can leave business-critical processes trapped in a half-designed transition state.

Failure mechanism: When scope, process ownership, or conversion criteria remain undecided, teams usually make assumptions to keep the project moving. Those assumptions can hard-code unnecessary customisation, weaken testing coverage, and expose cutover to surprise breakpoints in integrations, controls, or reporting.

Impact: The programme can slip, costs can rise, and the business may end up accepting a migration shape that is technically workable but operationally awkward for years. In the worst case, compressed decision-making forces a path that increases disruption at go-live and reduces confidence in the new platform.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

FrameworkControl / ReferenceRelevance
NIST CSF 2.0GV.1 — Cybersecurity Policy, Expectations, and StrategyMigration planning is a governance decision tied to business objectives and risk tolerance.
ID.AM — Asset ManagementA clear inventory of customisations, integrations, and dependencies is central to choosing the migration path.
GV.2 — Roles, Responsibilities, and AuthoritiesA migration programme needs clear ownership for decisions, scope, and cutover accountability.
Recommendation — Define the migration strategy in governance terms and align it to business objectives and risk tolerance. Inventory systems, interfaces, and dependencies before committing to a migration approach. Assign decision ownership for scope, process design, and cutover readiness.
CIS Controls v8CIS 1 — Inventory and Control of Enterprise AssetsKnowing what exists is necessary before deciding what to carry forward or retire.
CIS 16 — Application Software SecuritySAP customisation and integration choices affect upgrade complexity and transition risk.
Recommendation — Establish a complete inventory of SAP-related assets and dependencies before selecting the target state. Review custom code and integrations early to reduce rework and migration complexity.

Practitioner Guidance

What to prioritise: Build a decision framework around business outcomes, process criticality, and dependency risk before finalising the migration path. The first question is not which conversion method is easiest to start, but which option best preserves control over the processes that matter most.

What to verify: Confirm that every major integration, report, and custom process has an owner, a migration disposition, and a test implication. If those three things are missing, the programme is not yet ready to lock the target state, even if the deadline is close.

Practitioner takeaway: The safest path is usually the one that makes the decision late enough to be informed, but early enough to preserve implementation quality and cutover control.

Deepen Your Knowledge

Sign up to our weekly newsletter — get 33% off our NHI Foundation Level Course

    NHIMG Editorial Note
    Reviewed and updated by the NHIMG editorial team on September 19, 2026.
    NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org