SAP system unstable or insecure.Verified Basis & Security admins ready in minutes.

The PM scopes the bottleneck in the first 15 minutes from your performance symptoms. In a Starter session the Basis admin runs ST03N workload analysis to identify whether the problem is database time, CPU, or roll/wait time, checks SM50/SM66 for stuck or long-running work processes, and reviews ST04 (DBACOCKPIT for HANA) for expensive SQL statements and missing indexes. They examine the parameter set in RZ10/RZ11 (memory areas, work process distribution between dialog and background, em/ist_max), inspect SM12 lock entries and SM13 update queue backlogs, and review the buffer hit ratios in ST02. You receive a documented root-cause finding, the specific parameter or index changes applied, and before-and-after ST03N metrics so you can confirm the improvement holds under real load.

Yes. The PM scopes the refresh type in the first 15 minutes homogeneous (same OS/DB) or heterogeneous. For a standard homogeneous system copy the Basis admin uses SWPM (Software Provisioning Manager) with a database-specific backup/restore for HANA, Oracle, or ASE, or the export/import method via R3load where required. They handle the full post-copy sequence: BDLS for logical system name conversion, license re-installation via SLICENSE, RFC re-pointing in SM59, STMS transport domain reconfiguration, profile parameter adjustment for the target sizing, and reset of operational data (printers in SPAD, jobs in SM37, batch users). For HANA they manage the tenant database copy and the secure store (hdbuserstore) re-keying. The admin documents the runbook so your team can repeat the refresh on a schedule.

Yes, role and authorization work is fully remote. The PM scopes whether you need a greenfield role build or remediation of an existing mess. The Basis/Security admin uses PFCG to build composite and single roles around your business process matrix, derives roles for organizational levels (company code, plant, sales org) to avoid role explosion, and runs SU24 maintenance so authorization defaults stay in sync with transactions. For cleanup they use ST01/STAUTHTRACE and SU53 to capture the authorizations users actually need, eliminate SAP_ALL and wide-open profiles, and resolve segregation-of-duties conflicts. If you run SAP GRC Access Control they configure ARA risk analysis rulesets and ARM access request workflows. You get a documented role matrix and a remediation report listing every conflict closed.

The admin works through STMS in a controlled three-system landscape (DEV QA PRD). They verify the transport domain and routes are correct, enforce an import sequence so objects move in dependency order, and use transport-of-copies for hotfixes that must not carry the full change list. Before any production import they check the transport logs for return codes (8 = error, 4 = warning needing review), validate that no objects are locked in conflicting requests via SE03, and schedule imports during your defined maintenance window with a rollback plan. For risky changes they recommend ChaRM (Change Request Management via Solution Manager) or at minimum a documented import-and-verify checklist. They never import untested requests directly to production and document every PRD import with timestamp and approver.

A recurring engagement covers the operational backbone that keeps SAP stable. The admin monitors system health daily via the EarlyWatch Alert and ST06 OS collector, manages background job scheduling and failures in SM37, clears spool and update errors, and watches the HANA or database growth with housekeeping jobs (table reorganization, audit log cleanup, ST22 dump review). They apply SAP Notes and Support Packages via SPAM/SAINT during maintenance windows, manage kernel upgrades, and keep the SAP HANA revision current. Security tasks include reviewing SM19/SM20 audit logs, patching reported vulnerabilities, and rotating service-account credentials. They also own backup verification and periodic restore tests so your recovery actually works. Everything is documented in a runbook so the work is auditable and repeatable.