Secure your cloud and SAP estate, and show auditors the evidence.
We put security guardrails, encryption, logging and posture management in place across AWS, Microsoft Azure and Google Cloud, and keep them working. You get a clear split of responsibilities, controls mapped to ISO 27001 and data protection law, and evidence ready for audits and Sri Lanka's PDPA.
Why cloud security needs ongoing attention
Cloud providers secure their own infrastructure, but the configuration of accounts, networks, identities and data is the customer's job. Most cloud incidents come from settings that drift over time: a storage bucket made public, a missing log, an over-privileged account. At the same time regulation is tightening. In Sri Lanka, the Personal Data Protection Act, No. 9 of 2022, as amended, brings its core obligations for controllers and processors into force on 1 January 2027, including duties on data protection officers, breach notification, impact assessments and cross-border transfers.
Shared responsibility gaps
Each provider secures the cloud itself, while you secure what you put in it. Under RISE with SAP a third party, SAP, adds another boundary to manage.
Configuration drift
Settings that were right at go-live change over time. Without continuous posture checks, nobody notices until an audit or an incident.
Missing evidence
Auditors for ISO 27001, SOC reports and data protection law want proof that controls work, not just policies.
Data location questions
There is no hyperscaler region in Sri Lanka, so personal data is processed abroad, usually in India or Singapore. That needs to be handled under the PDPA cross-border rules.
What we do
We design, build and run security controls for SAP and non-SAP workloads, and help you prove compliance.
Landing zone guardrails
We set preventive controls at organisation level, such as allowed regions, blocked public access and required encryption. New accounts and subscriptions inherit them automatically.
Encryption and key management
We enable encryption at rest and in transit, with customer managed keys where your policy requires them. Key access and rotation are logged and reviewed.
Logging and monitoring
We centralise audit logs, network flow logs and SAP security logs in a protected location with defined retention. Alerts feed your security operations or ours.
Posture management
We turn on native posture tools, map their findings to your control framework and fix issues in priority order. Scores and trends are reported monthly.
Identity and access
We apply least privilege roles, multi-factor authentication and privileged access controls for cloud consoles and SAP administration. Access is reviewed on a regular cycle.
Compliance and audit support
We map controls to ISO/IEC 27001, the Sri Lanka PDPA and other rules that apply to you, and collect evidence for audits. We help you use provider ISO certificates and SOC reports as part of your own assurance.
How it works
- 1
Assess
We review your cloud accounts, SAP security setup and current policies against a baseline such as the CIS benchmarks and your own requirements. You get a prioritised findings list.
2 to 4 weeks - 2
Design
We define the responsibility matrix, guardrails, logging design, key management approach and data residency position. Each control is mapped to the standards that matter to you.
2 to 3 weeks - 3
Implement
We deploy guardrails, logging, encryption and posture tools, preferably as code. High risk findings from the assessment are fixed first.
4 to 8 weeks - 4
Operate and evidence
We monitor posture, handle findings and keep audit evidence current. We support you through internal and external audits.
Ongoing
Native security services on each cloud
We start from each provider's own security services and connect them into one view.
| Need | AWS | Microsoft Azure | Google Cloud |
|---|---|---|---|
| Organisation guardrails | AWS Organizations service control policies and AWS Control Tower | Azure Policy and management groups | Organization Policy Service |
| Posture management | AWS Security Hub with Security Hub CSPM | Microsoft Defender for Cloud | Security Command Center |
| Key management | AWS Key Management Service | Azure Key Vault and Azure Key Vault Managed HSM | Cloud Key Management Service |
| Audit logging | AWS CloudTrail | Azure Monitor activity log and Log Analytics | Cloud Audit Logs |
| Threat detection and SIEM | Amazon GuardDuty | Microsoft Sentinel | Google Security Operations |
| Compliance reports | AWS Artifact | Microsoft Service Trust Portal | Compliance Reports Manager |
Security responsibilities for SAP
Security work depends on how SAP runs. Under RISE with SAP, SAP runs the infrastructure, operating system, database and core Basis on the hyperscaler you chose, and SAP handles their security monitoring and patching. You remain responsible for business roles and authorisations, single sign-on through your identity provider, tenant security settings, application audit logs, integrations, custom code and the network link into SAP's environment. If you run ECC or SAP S/4HANA yourself on a cloud subscription, you also own the full stack below the application, and our controls cover it end to end.
- Responsibility matrix for RISE with SAP, SAP BTP and your own cloud accounts
- Monthly review of SAP security notes for systems you run yourself
- SAP security audit log and identity integration with your central logging
- PDPA impact assessments and records for SAP, Salesforce and HR systems that hold personal data
© 2026 Mawkish Technologies. This guide, its diagrams and illustrations are protected by copyright. You’re welcome to learn from it and to quote it with credit and a link. Reproducing it, by hand or through AI, and publishing it as your own is not allowed. Read our copyright notice
Deliverables
- Security assessment with prioritised findings
- Shared responsibility matrix covering you, us, SAP and each cloud provider
- Deployed guardrails, logging, encryption and posture management
- Control mapping to ISO/IEC 27001 and the Sri Lanka PDPA
- Data residency and cross-border transfer register
- Monthly posture report and audit evidence pack
Frequently asked
What is the shared responsibility model?
Cloud providers are responsible for the security of the cloud: data centres, hardware and the core platform. You are responsible for security in the cloud: your configuration, identities, data and applications. With RISE with SAP, SAP takes on more of the stack, but business access and data remain yours.
When does Sri Lanka's PDPA apply?
Gazette Extraordinary No. 2498/16 of 22 July 2026 set 1 January 2027 for sections 2 and 3, Part I and Part III of the Personal Data Protection Act, No. 9 of 2022, as amended. Some other parts, such as data subject rights and administrative penalties, have not yet been given a start date. We recommend taking legal advice on how the Act applies to your organisation.
Can our personal data be stored outside Sri Lanka?
There is no AWS, Azure or Google Cloud region in Sri Lanka, so cloud hosting means processing abroad. The PDPA, as amended in 2025, allows cross-border transfers when the controller meets the Act's obligations and uses safeguards that the Data Protection Authority specifies, with extra limits possible for public authorities. We help you record transfers and apply the required safeguards.
Do the cloud providers' ISO and SOC reports cover us?
They cover the provider's part of the shared responsibility model, and you can use them as evidence for that part. Your own controls, such as access, configuration and data handling, still need to be designed, run and evidenced by you or by us on your behalf.
Can you work with our existing security team or SOC?
Yes. We can feed alerts and posture findings into your SIEM and ticketing tools, and agree which team handles which type of event. Where you have no security operations function, we can cover cloud and SAP specific monitoring.
Often paired with this
Plan your move with people who know SAP.
One working session with our cloud and SAP architects. You leave with the options, the risks and a first plan.
- Your landscape reviewed
- The right cloud and region
- A first roadmap
Sources
- Daily FT: PDPA compliance regime from 1 Jan 2027
- Gazette Extraordinary No. 2498/16
- Daily Mirror: staggered PDPA rollout
- Readme.lk: PDPA No. 9 of 2022 and Amendment No. 22 of 2025
- Concentric: PDPA amended Section 26 summary
- NSAI: ISO/IEC 27001:2022 transition
- AWS: Security Hub generally available
- AWS shared responsibility model
- SAP: Securing RISE with SAP
Our Junhaven Baseline is the name we give to how we handle Cloud Security & Compliance: one accountable partner, from the first meeting to long after go-live.
AWS, Microsoft Azure, Google Cloud and SAP are trademarks of their respective owners.