Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 5 of 5

Security Patch Day

10 min

Listen to this lesson

0:00 / 7:11

Security corrections follow their own rhythm. SAP publishes security fixes as SAP Security Notes on Security Patch Day, the second Tuesday of every month, aligned with other major vendors' patch days. At Contoso, the October 2026 Patch Day fell on Tuesday 13 October. A platform team that reviews each patch day, decides quickly and implements in a controlled way keeps its exposure short without turning every month into a fire drill.

What gets published

SAP distinguishes Patch Day Security Notes, published on the monthly date, from Support Package Security Notes, whose fixes are included in support packages and applied automatically when you import them. Each security note has a priority; SAP's page states that high-priority notes correspond to a CVSS score of 7.0 or higher, and SAP's highest priority category is known as HotNews. Since June 2019, SAP delivers fixes for new high or very high severity notes only for support packages shipped in the last 24 months, which is another reason to keep stacks current.

Two delivery paths for security fixes, and why falling behind on stacks matters: new high-severity fixes are only delivered for support packages from the last 24 months.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-203
  1. CollectOn Patch Day, list new and updated security notes for Contoso's products (SAP for Me, Security Notes section)
  2. FilterKeep notes relevant to installed components and versions; record "not relevant" with a reason
  3. AssessCombine SAP priority and CVSS with Contoso's exposure: internet-facing, RFC-reachable, business-critical
  4. DecideEmergency, next regular change, next stack, or not applicable; record owner and due date
  5. Implement and testSNOTE in CMD, transport, targeted test in CMQ, import into CMP
  6. VerifyConfirm implementation status in each system; close the item with evidence
A monthly Security Patch Day routine.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-203

Prioritizing

SAP's priority and CVSS score tell you how severe a weakness is in general. Your exposure tells you how much it matters for you. A high-priority note for a component that is reachable from the internet through SAP Web Dispatcher is urgent. The same note for a component that is installed but not used, or only reachable inside a segmented network, may safely wait for the next regular change. Write the reasoning down: auditors ask why a note was deferred, not only whether it was implemented.

High severity, limited exposureNext regular change window, with interim mitigation if one is documented
High severity, high exposureEmergency change: implement and test within days
Lower severity, limited exposureBundle with the next support package stack
Lower severity, high exposureNext regular change window; review mitigations
A simple prioritization grid. Contoso's security policy sets the actual time limits.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-203

Tools that help

  • SAP for Me: the Security Notes section lists all security notes and patch day notes.
  • System Recommendations in SAP Solution Manager (still used for Contoso's ECC landscape) calculates relevant security and other notes per system.
  • Maintenance Planner offers security notes integration when planning stacks.
  • SNOTE implements the correction, and its status shows whether each system has it.

Evidence auditors ask for

Security patching is a favorite audit topic, and the questions are predictable: which notes were published, which were relevant, when were they implemented in each system, and who approved any deferral. Keep a simple monthly register: patch day date, note number, priority, relevance decision, owner, target date, status per system and evidence (the transport and the SNOTE status). Do not forget the legacy ECC landscape: while EP1 is still in use, its security notes need the same discipline, even if the program's attention is on S/4HANA.

One entry in the monthly security register: it closes only when CMP shows the note implemented or a deferral is approved and documented.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-203

What would you do?

On Patch Day, SAP publishes a HotNews note for a component that Contoso exposes to its fleet customers over the internet. The next planned change window is in three weeks. What should Sam recommend?

Key points
  • Security Patch Day is the second Tuesday of every month.
  • Patch Day notes are published monthly; support package security notes arrive with support packages.
  • Prioritize by SAP priority and CVSS combined with Contoso's exposure; document deferrals.
  • Track implementation per system until production is protected.

Check your understanding · not graded

Lesson check

  1. 1. When is SAP Security Patch Day?

  2. 2. Which CVSS score marks a high-priority security note on SAP's page?

  3. 3. What decides whether a high-priority note is an emergency for Contoso?

  4. 4. When is a security note item complete?