Mainstream Maintenance for SAP GRC AC 12.0 ends on December 31, 2027. Extended Support costs +20% per year. Before you commit to a strategy, we help you estimate the real migration effort to GRC 2026 (typically 300–800 MD) and plan it around your organisation's cadence.
SAP's Mainstream Maintenance model gives you a clear calendar. Understanding it precisely lets you plan without panic — and without waiting too long.
No new features, no legal updates for new regulations, no patches for newly disclosed CVEs. Your auditor will start asking questions.
Extended Support at +20% annual cost. Available for up to 3 years. Buys you time but does not remove the need to migrate.
Custom Support only (per-request, no SLA) until 2033. Not a viable operating model for a control-critical system.
Practical implication for your internal audit function: if an auditor in 2028 asks "why are you running a system past Mainstream Maintenance?" you need a documented strategy and a real action plan. Both take time to prepare properly.
We are not selling you a specific path. Our job is to help you analyse which one makes sense in your context. Below we describe Path A in depth because that is what we deliver most often for organisations who have decided to stay on SAP GRC.
Move to the current supported version. Preserves your existing GRC investment, custom workflows, and internal knowledge.
Buy time by paying +20% annually for continued patches. Useful when other priorities are consuming your project capacity right now.
Continue on an out-of-support version. Rarely a real strategy, but worth naming explicitly because organisations sometimes default here without deciding.
We are writing this without marketing spin. If GRC 2026 does something slower or worse than your current 12.0 setup, we will tell you in the assessment.
The 500 MD baseline reflects the typical Enterprise landscape. Your specific number depends on how far from that baseline your environment is. Here is how we calibrate.
| Landscape | Systems | Users | MSMP flows | Effort MD | Indicative € |
|---|---|---|---|---|---|
| Small | 1 | 150–300 | 3–5 | 300 MD | ~€210k |
| Typical Enterprise | 3 | 1 000–2 000 | ~10 | 500 MD | ~€350k |
| Large / complex | 5+ | 2000+ | 20+ | 800 MD | ~€560k |
Same structure across all 40+ engagements. Adjustments happen inside the phases, never in the top-level plan.
No surprises after signature. This is the full list of what a standard 500 MD engagement covers.
Users, roles, SoD rulebook, mitigation controls, EAM (Firefighter) IDs and policies, workflow customizations (MSMP + BRF+), BRM catalogue, HR-triggered movers & leavers integration.
Continuous compliance monitoring rules (data sources + business rules), key master data (organizations, regulations, controls, business processes, risks), workflows for monitoring & testing including MCP (Master Data Compliance).
Risk catalogue, KRIs, incident logs, response plans. Historical risk assessment records.
Risk rules migration, ruleset structure, mitigation library, historic risk analysis reports, integration with ARM for pre-approval simulation.
Custom queries, BI extractors, audit reports, GRC-specific views. All rebuilt against the new data model.
SAP source connections (S/4, ECC, BW), non-SAP integrations, ITSM webhooks, IAM tools.
We do not go looking for problems in your assessment — but experience says these are the ones that most often trip organisations up. Here is how we prevent them.
| Risk | Our approach | Historical result |
|---|---|---|
| Custom Z-code incompatibility with HANA | Assessment phase weeks 1–4 catches 95% of incompatibilities before delivery starts | 15/15 recent projects — no surprises |
| Workflow customizations (MSMP + BRF+) | Full inventory in phase 1; each customization (agents, custom rules, BRF+ decision tables) planned individually | Included in baseline scope, no surprise add-ons |
| Add-on version conflict | Compatibility check in week 2, decisions with client in week 4 | Preemptive resolution before delivery |
| Downtime window too small | Standard 48h cutover with rollback plan, tested in UAT | 0 failed cutovers requiring rollback |
| Historic Firefighter logs | 12 months migrated (audit horizon), older logs to cold archive in GCS or S3 | ISO 27001 retention compliant |
You do not need to have decided anything yet — pick the option that matches where you are today.
Free, no commitment. Let us talk about your landscape, your S/4HANA plans, your calendar and budget — you leave with a clear view of whether Path A makes sense.
Book a slotOur standard Assessment playbook to share with your team. Contains pre-flight checklist, decision calendar, MD estimate template, questions for SAP support. 8 pages.
Download PDFAnonymised project plan from one of our recent engagements — shows the real format of deliverables, milestones, and ownership matrix. 4 pages.
Request by emailPDF will be attached to the reply within one business day.