Operating Model in the Kyma Environment

This operating model clearly defines the separation of tasks between SAP and the customer during all phases of a project.

The responsibilities for operating the SAP BTP, Kyma runtime are listed in the following service catalog.

Note:

The following information is valid for the managed offering, SAP BTP, Kyma runtime, not for the open source project "Kyma".

Service Catalog

Process	Task	Responsibility
Communication Management	Appoint an English-speaking contact person and communicate the name to SAP. This is required to ensure timely processing of configuration change requests affecting the customer system, interacting with SAP for efficient case processing, and other interaction between SAP and the customer.	Customer
Communication Management	Subscribe to the communication channels offered by SAP for receiving prompt information about any service disruptions, critical maintenance activities affecting the customer system, and change requests requiring action on the customer side.	Customer
Communication Management	Inform the customer about service disruptions and critical maintenance activities affecting the customer system.	SAP
Asset Management	Manage the hardware and infrastructure resources in the region, from acquisition through disposal. This includes the request and approval process, procurement management, lifecycle management, and disposal management.	SAP
Asset Management	Protect IT assets such as systems, network, and data from threats that arise from unauthorized physical access or physical influence on those assets.	SAP
Provisioning	Provision resources and systems to customers in accordance with the ordered package and subscriptions. This includes the allocation and provisioning of technical (physical and virtual) resources, such as storage, network, compute units, systems, and database hosts, the deployment of SAP's application software and the proper initial configuration of quotas, service subscriptions, permissions, and trust configuration.	SAP
Provisioning	Provide a quota according to the ordered package and subscriptions that can be used to enable resources and services (for example, subscribing to a service). Kyma runtime offers a consumption-based service plan. Hence, you can limit the resources (and costs) by configuring the minimum and maximum VMs. Such a configuration impacts the resources (compute units) available for developers to deploy applications.	Customer
Change Management	Apply regular product increments, as well as corrections to the infrastructure, systems, and services to avoid cases with minimal possible disruption of normal operations. Ensure that all platform changes (such as updates of the runtime or operating system patches, but not of the customer applications) are evaluated, authorized, prioritized, planned, tested, implemented, documented, and reviewed prior to implementation.	SAP
Change Management	Perform updates of the infrastructure, systems, and services if required. Respectively, for selected services, offer self-services for applying controlled updates of new versions. Emergency changes, for example, triggered by Case Management processes, have accelerated testing, approval, and implementation.	SAP
Change Management	Ensure prompt delivery of security patches via the Security Patch Management process. Apply the security patches on live customer systems (application runtimes or databases), in case the patches don’t require downtime, or if the vulnerable system puts at risk SAP or other customers. Inform the customers about the availability of security patches.	SAP
Change Management	Handle any security patches to Java or any other languages. You have to create a new Docker image and update the applications to use the new image. Adopt the latest patches or updates by restarting applications when necessary. For example, when a security issue arises.	Customer
Case Management	Process cases reported by the customer according to the Service Level Agreement. The case is recorded and prioritized in the case tracking system. Monitor the status and progress of the case throughout its whole lifecycle and give regular status updates to the customer.	SAP
Case Management	In the event of cases, make reasonable effort to support end users and manage their cases, to explore self-help tools to find already documented solutions, and to liaise with SAP support in the event of new problems to ensure timely processing of cases affecting the resources in the customer account.	Customer
Case Management	Confirm case resolution in the case tracking system.	Customer
Service Requests	Process service requests reported by the customer according to the Service Level Agreement. The service request is recorded and prioritized in the service request tracking system. Monitor the status and progress of the service request throughout its whole lifecycle and give regular status updates to the customer.	SAP
Service Requests	Confirm service request completion in the service request tracking system.	Customer
Backup & Restore	Perform a backup of the database systems hosted in the subaccount. A database log backup is done according to the Service Level Agreement and stored on the primary storage. The logs are transferred from primary to secondary storage according to the Service Level Agreement. Full data backup is done every day. Note: If you as a customer deploy your custom databases, you're then responsible. See Volume Backup for Customer Data.	SAP Customer
Backup & Restore	Restore previously backed-up data to recover to a consistent state. Note: For some database services, there is a self-service for the restore process. Verify the completeness of the restored data based on log files created during the recovery and smoke tests to verify the system’s consistency. Note: If you as a customer deploy your custom databases, you're then responsible. See Volume Backup for Customer Data.	SAP Customer
Backup & Restore	Give regular status updates to the customer throughout the entire restore procedure. This responsibility is applicable only for the SAP BTP database services. Note: If you as a customer deploy your custom databases, you're then responsible. See Volume Backup for Customer Data.	SAP Customer
Backup & Restore	Collaborate with SAP to ensure timely processing of data restores if required. This responsibility is applicable only for the SAP BTP database services.	Customer
Backup & Restore	Validate logical integrity and consistency of the restored data.	Customer
User Access Management	Manage users, permissions, and security configurations within the subaccount.	Customer
System Monitoring	Ensure availability of the customer system according to the Service Level Agreements as agreed in the contractual agreement between SAP and the customer, by active monitoring, prompt issue detection, and case prevention.	SAP
System Monitoring	Monitor the resource consumption (memory, CPU, storage) to detect issues in technical operations.	SAP
Malware Management	Ensure that the infrastructure and platform services are free of viruses, spam, spyware, and other malicious software. If malware is detected, an auto-notification is generated, which is assessed and resolved by SAP. Note: If your custom application has vulnerabilities, you as a customer are responsible to fix them, to build a new Docker image, and to update the application.	SAP Customer
Application Management	Design, develop, deploy, configure, maintain, and operate the application within the subaccount. This includes maintaining a staged environment for application delivery (if required), application resource management, and managing application availability and performance.	Customer
Application Management	Provide infrastructure, tools, and application programming interfaces for the lifecycle management and operations of the application in the subaccount.	SAP
Application Management	Regularly adopt the latest versions of the tools for lifecycle management and operations offered at the SAP Development Tools site.	Customer
Network Management	Manage the network isolation of the subaccounts provisioned to the customer.	SAP
Network Management	Operate the network infrastructure transparently for customers, ensuring elasticity, high availability, and security.	SAP
Network Management	Create and manage a custom Web domain for the application in the subaccount to ensure data isolation.	Customer
Network Management	Create and manage the default SAP Web domain for the application in the subaccount to ensure data isolation.	SAP
Penetration Testing	Inform SAP about any penetration testing that shall be performed for the customer account and ask for their approval. Testing isn’t allowed on any resources shared with other customers. The results, if any, from the test are to be treated strictly as the confidential information of SAP and the customer aren’t to be shared with any person or entity without explicit written authorization from SAP. Customers are required to share the results with SAP and work together with SAP's operations to mitigate or remedy any security issues.	Customer
Decommissioning	Ensure the secure deletion of data and hardware disposal. This includes the disassembling of systems along with peripherals and their removal from the region. Before dismantling and handover for further use or return to the vendor, the data is wiped securely from the system.	SAP