## 8.4.3  Comparison between the Operating Models of Kyma and Cloud Foundry Runtimes
This operating model clearly defines the separation of tasks between SAP and the customer. It's relevant for all phases of a project for both environments.
The responsibilities for operating the Cloud Foundry and Kyma runtimes are described in the following service catalog.
Service Catalog
| Process                    | Task                                                                                                                                                                                                                                                                                                  | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Communication Man- agement | Appoint an English- speaking contact person and communicate the name to SAP. This is re- quired to ensure timely processing of configura- tion change requests affecting the customer system, interacting with SAP for efficient case processing, and other interaction between SAP and the customer. | Customer                          | Customer                 | No            |
| Communication Man- agement | Subscribe to the com- munication channels of- fered by SAP for receiv- ing prompt information about any service dis- ruptions, critical mainte- nance activities affect- ing the customer sys- tem, and change re- quests requiring action on the customer side.                                      | Customer                          | Customer                 | No            |
| Communication Man- agement | Inform the customer about service disrup- tions and critical main- tenance activities affect- ing the customer sys- tem.                                                                                                                                                                              | SAP                               | SAP                      | No            |
| Process          | Task                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Asset Management | Manage the hardware and infrastructure re- sources in the region, from acquisition through disposal. This includes the request and ap- proval process, procure- ment management, life- cycle management, and disposal management.                                                                                                                                                                                                                           | SAP                               | SAP                      | No            |
| Asset Management | Protect IT assets such as systems, network, and data from threats that arise from unau- thorized physical access or physical influence on those assets.                                                                                                                                                                                                                                                                                                     | SAP                               | SAP                      | No            |
| Provisioning     | Provision resources and systems to customers in accordance with the or- dered package and sub- scriptions. This includes the allocation and pro- visioning of technical (physical and virtual) re- sources, such as stor- age, network, compute units, systems, and da- tabase hosts, the de- ployment of SAP's ap- plication software and the proper initial config- uration of quotas, serv- ice subscriptions, per- missions, and trust con- figuration. | SAP                               | SAP                      | No            |
| Process           | Task                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Provisioning      | Provide a quota accord- ing to the ordered pack- age and subscriptions that can be used to en- able resources and serv- ices (for example, sub- scribing to a service). Kyma runtime doesn't offer a subscription- based service plan, but a consumption-based one. However, you can limit the resources (and costs) in other ways. What you can still con- figure is the minimum and maximum VMs for a Kyma runtime. This impacts the resources (compute units) availa- ble in a Kyma runtime for developers to deploy | Customer                          | Customer                 | Yes           |
| Change Management | Apply regular product increments, as well as corrections to the infra- structure, systems, and services to avoid cases with minimal possible disruption of normal op- erations. Ensure that all platform changes (such as updates of the run- time or operating sys- tem patches, but not of the customer appli- cations) are evaluated, authorized, prioritized, planned, tested, imple- mented, documented, and reviewed prior to implementation.                                                                     | SAP                               | SAP                      | No            |
| Process           | Task                                                                                                                                                                                                                                                                                                                                                                                     | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Change Management | Perform updates of the infrastructure, sys- tems, and services if required. Respectively, for selected services, offer self-services for applying controlled up- dates of new versions. Emergency changes, for example, triggered by Case Management proc- esses, have accelerated testing, approval, and implementation. The updates for the Cloud Foundry runtime are performed in bi- | SAP                               | SAP                      | Yes           |
| Process           | Task                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Change Management | • Ensure prompt de- livery of security patches via the Se- curity Patch Man- agement process. • Provision new data- base systems and Java applications with the latest patched versions in the Cloud Foundry runtime. In the Kyma runtime, you as a customer are re- sponsible for han- dling any security patches to Java or any other lan- guages. You have to create a new Docker image and update the applica- tions running in the Kyma runtime to use the new image. • Apply the security patches on live cus- tomer systems (ap- plication runtimes or databases), in case the patches don't require down- time, or if the vulnerable system puts at risk SAP or other customers. • Inform the custom- ers about the avail- ability of security patches. | SAP                               | SAP Customer             | Yes           |
| Process           | Task                                                                                                                                                                                                                                                                                 | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Change Management | Adopt the latest patches or updates by restart- ing applications when necessary. For example, when a security issue arises. In the Cloud Foundry runtime, you can also adopt the latest patches or updates via the avail- able self-services.                                        | Customer                          | Customer                 | Yes           |
| Change Management | Ensure that any custom configurations are cor- rect. Note: If you, as a cus- tomer, introduce any wrong or expired config- urations or credentials that cause errors or warnings, you're then responsible for fixing them.                                                           | Customer                          | Customer                 | No            |
| Case Management   | Process cases reported by the customer accord- ing to the Service Level Agreement. The case is recorded and priori- tized in the case track- ing system. Monitor the status and progress of the case throughout its whole lifecycle and give regular status updates to the customer. | SAP                               | SAP                      | No            |
| Process          | Task                                                                                                                                                                                                                                                                                                                                         | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Case Management  | In the event of cases, make a reasonable ef- fort to support end users and manage their cases, to explore self- help tools to find already documented solutions, and to liaise with SAP support in the event of new problems to en- sure timely processing of cases affecting the re- sources in the customer account.                       | Customer                          | Customer                 | No            |
| Case Management  | Confirm case resolution in the case tracking sys- tem.                                                                                                                                                                                                                                                                                       | Customer                          | Customer                 | No            |
| Service Requests | Process service re- quests reported by the customer according to the Service Level Agree- ment. The service re- quest is recorded and prioritized in the serv- ice request tracking sys- tem. Monitor the sta- tus and progress of the service request through- out its whole lifecycle and give regular sta- tus updates to the cus- tomer. | SAP                               | SAP                      | No            |
| Service Requests | Confirm service request completion in the serv- ice request tracking sys- tem.                                                                                                                                                                                                                                                               | Customer                          | Customer                 | No            |
| Process         | Task                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Backup &Restore | Perform a backup of the database systems hosted in the subac- count. A database log backup is done accord- ing to the Service Level Agreement and stored on the primary storage. The logs are transfer- red from primary to sec- ondary storage accord- ing to the Service Level Agreement. Full data backup is done every day. Note: If you as a cus- tomer deploy your cus- tom databases in the Kyma runtime, you're then responsible. See Volume Backup for Cus- | SAP                               | SAP Customer             | Yes           |
| Backup &Restore | Restore previously backed-up data to recover to a consis- tent state. Note: For some database services, there's a self-service for the restore process. Ver- ify the completeness of the restored data based on log files created dur- ing the recovery and smoke tests to verify the system's consistency. Note: If you as a cus- tomer deploy your cus- tom databases in the Kyma runtime, you're then responsible. See Volume Backup for Cus- tomer Data.         | SAP                               | SAP Customer             | Yes           |
| Process                  | Task                                                                                                                                                                                                                                                                                                                                       | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Backup &Restore          | Give regular status up- dates to the customer throughout the entire re- store procedure. In the Kyma runtime, this responsibility is ap- plicable only for the SAP BTP database services. Note: If you as a cus- tomer deploy your cus- tom databases in the Kyma runtime, you're then responsible. See Volume Backup for Cus- tomer Data. | SAP                               | SAP Customer             | Yes           |
| Backup &Restore          | Collaborate with SAP to ensure timely process- ing of data restores if re- quired. In the Kyma runtime, this responsibility is ap- plicable only for the SAP BTP database services.                                                                                                                                                        | Customer                          | Customer                 | Yes           |
| Backup &Restore          | Validate logical integrity and consistency of the restored data.                                                                                                                                                                                                                                                                           | Customer                          | Customer                 | No            |
| User Access Manage- ment | Manage users, permis- sions, and security con- figurations within the subaccount. For Kyma runtime, man-                                                                                                                                                                                                                                   | Customer                          | Customer                 | Yes           |
| Process            | Task                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| System Monitoring  | For Cloud Foundry runtime, ensure availa- bility of the customer system according to the Service Level Agree- ments as agreed in the contractual agree- ment between SAP and the customer, by active monitoring, prompt is- sue detection, and case prevention. For Kyma runtime, en- sure availability of the Kyma runtimeaccording to the Service Level Agreements as agreed in the contractual agree- ment between SAP and the customer, by active monitoring, prompt is- | SAP                               | SAP                      | Yes           |
| System Monitoring  | Monitor the resource consumption (memory, CPU, storage) to detect issues in technical oper- ations.                                                                                                                                                                                                                                                                                                                                                                          | SAP                               | SAP                      | No            |
| Malware Management | Ensure that the infra- structure and platform services are free of vi- ruses, spam, spyware, and other malicious software. For Cloud Foundry runtime, if malware is detected, an auto-noti- fication is generated, which is assessed and resolved by SAP.                                                                                                                                                                                                                    | SAP                               | SAP                      | Yes           |
| Process                      | Task                                                                                                                                                                                                                                                                                                                                                       | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Malware Management           | Ensure that all resour- ces like functions and images are free of vi- ruses, spam, spyware, and other malicious software. For Cloud Foundry runtime, SAP ensures that platform compo- nents like buildpacks, stemcells, container im- ages are free of mal- ware. However, you as a customer are responsi- ble for your own applica- tion code and depend- | SAP Customer                      | Customer                 | Yes           |
| Vulnerabilities Manage- ment | Check regularly for vul- nerabilities in your cus- tom applications. If you find such, ensure they're mitigated in time. For Cloud Foundry runtime, SAP checks the OSpatches, stemcells, buildpacks, and runtime. However, you as a cus- tomer are responsible for the application-level dependencies and libra- ries.                                     | SAP Customer                      | Customer                 | Yes           |
| Process                  | Task                                                                                                                                                                                                                                                                                                                                                                                                         | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Application Manage- ment | Design, develop, deploy, configure, maintain, and operate the application within the subaccount. This includes maintain- ing a staged environ- ment for application de- livery (if required), ap- plication resource man- agement, and managing application availability and performance. For Kyma runtime, de- sign, develop, deploy, configure, maintain, and operate the application also within the Kyma | Customer                          | Customer                 | Yes           |
| Application Manage- ment | Provide infrastructure, tools, and application programming interfaces for the lifecycle manage- ment and operations of the application in the subaccount.                                                                                                                                                                                                                                                    | SAP                               | SAP                      | No            |
| Application Manage- ment | Regularly adopt the lat- est versions of the tools for lifecycle man- agement and operations offered at the SAP De- velopment Tools site.                                                                                                                                                                                                                                                                    | Customer                          | Customer                 | No            |
| Process                  | Task                                                                                                                                                                                                                                                                                                                                                       | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Application Manage- ment | Ensure your application configurations are hard- ened according to best practices. For Cloud Foundry runtime, SAP provides hardened container de- faults, no root access, and isolation. However, you as a customer are responsible for se- cure application config- uration and secrets. For Kyma runtime, see Kubernetes Pod Secur- ity Recommendations. | SAP Customer                      | Customer                 | Yes           |
| Network Management       | Manage the network isolation of the subac- counts provisioned to the customer.                                                                                                                                                                                                                                                                             | SAP                               | SAP                      | No            |
| Network Management       | Operate the network infrastructure transpar- ently for customers, en- suring elasticity, high availability, and security.                                                                                                                                                                                                                                  | SAP                               | SAP                      | No            |
| Network Management       | Create and manage own Web domain for the ap- plication in the subac- count to ensure data isolation.                                                                                                                                                                                                                                                       | Customer                          | Customer                 | No            |
| Process             | Task                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Network Management  | Create and manage the default SAP Web domain for the application in the subaccount to ensure data isolation. For Cloud Foundry runtime, SAP provides routing, domains, and isolation segments. However, you as a cus- tomer are responsible for any optional custom domains.                                                                                                                                                                                                                                                                                   | SAP Customer                      | SAP                      | Yes           |
| Penetration Testing | Inform SAP about any penetration testing that shall be performed for the customer account and ask for their appro- val. Testing isn't allowed on any resources shared with other customers. The results, if any, from the test are to be treated strictly as the confiden- tial information of SAP and the customer aren't to be shared with any person or entity without explicit written authori- zation from SAP. Cus- tomers are required to share the results with SAP and work together with SAP's operations to mitigate or remedy any security issues. | Customer                          | Customer                 | No            |
| Process         | Task                                                                                                                                                                                                                                                                                          | Responsibility in Cloud Foundry   | Responsibility in Kyma   | Differences   |
|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------|---------------|
| Decommissioning | Ensure the secure dele- tion of data and hard- ware disposal. This in- cludes the disassem- bling of systems along with peripherals and their removal from the region. Before disman- tling and handover for further use or return to the vendor, the data is wiped securely from the system. | SAP                               | SAP                      | No            |
Parent topic: Operating Model [page 3317]
## Related Information
Operating Model in the Cloud Foundry Environment [page 3318] Operating Model in the Kyma Environment [page 3324]
SLAs for Cloud Services