Moving to RISE with SAP is often marketed as the moment your SAP Basis team finally gets to step back. But anyone who reads the official Roles & Responsibilities (R&R) documentation alongside SAP Note 3375877 will spot a critical double bind: SAP is retiring its central automation tool, LaMa (SAP Landscape Manager), while simultaneously confirming that 144 tasks - the so-called "Excluded Tasks" - remain entirely the customer's responsibility. This article explains why the Empirius EPOS Suite is the bridge that closes this automation gap.
The marketing pitch for RISE with SAP (S/4HANA Cloud Private Edition) is compelling: SAP takes over operations, infrastructure, and maintenance — a "no-Basis" future. For SAP Basis teams responsible for the stability and efficiency of their landscapes, however, the devil is firmly in the details — specifically in the SAP Roles & Responsibilities Matrix*. Look closely and a pattern emerges: a double bind that could catch many organizations completely off guard.
This article is based on the 56-page R&R document v.3.2026. A link is provided under graph 1.
A direct on-premise or hybrid successor from SAP? There isn't one.
At the same time, the official RISE Roles & Responsibilities Matrix (version 3.2026) confirms that 144 tasks - classified as "Excluded Tasks" - remain exclusively the customer's responsibility. The work doesn't disappear. The tool to automate that work does.
The result is the "automation gap": you lose the tool (LaMa), but keep the responsibility (RISE Excluded Tasks).
A standard RISE contract offers four categories of services, alongside a defined list of excluded tasks. Here is what is currently included:
- Standard Services (490)
- Additional Services (63)
- Optional Services (57)
- Packaged Services (183)
- 144 Excluded Tasks - 100% the customer's responsibility
Contrary to what many organizations expect, RISE is not a fully managed, all-inclusive package. According to the current version of the R&R documentation (2026), there are numerous critical areas where the customer remains fully accountable - or faces significant manual effort.
All 144 Excluded Tasks fall 100% within the customer's scope. They are not available under any Standard, Additional, Optional, or Packaged Service. These are the tasks your own SAP Basis team will need to monitor, manage, and maintain going forward.
While SAP does offer standard system refreshes as part of its Standard Services, the surrounding processes are not automatically included. Pre-processing tasks before the refresh - such as exporting customer-specific configuration tables for PCA - and the logical integrity check after a restore are either chargeable Packaged Services or Excluded Tasks that fall to the customer. Without your own automation, these steps can stretch from hours into days.
System preparation, post-restore logical integrity validation, and especially the complex post-copy automation steps are typically the customer's responsibility.
In a RISE environment, a manual refresh process can take days due to ticket queues and manual steps. Empirius BlueCopy automates this entire "last mile." You retain full control over the quality and speed of your system copies - without waiting on SAP tickets.
Certificate validity monitoring is not an included Standard Service in RISE - it must be purchased as a Packaged Service. More critically, the entire CSR process (Certificate Signing Request) - obtaining a signed certificate from an external Certificate Authority - is an Excluded Task and sits entirely with the customer.
SAP will implement certificates on request, but tracking whether a certificate expires in 47 days is your problem.
The Empirius SAP Certificate Management App acts as an early warning system, proactively monitoring all certificate expiry dates and automating the renewal process before an expired certificate brings your operations to a halt.
Your team is notified automatically, and the renewal workflow is handled with as little manual intervention as possible - so RISE doesn't become a standstill.
SAP secures the infrastructure, but application-layer security operates under a shared responsibility model. The analysis of relevant SAP Security Notes is a Standard Service in RISE - but only for customers who have purchased the appropriate Cloud Application Services (CAS) packages. Customers without CAS must conduct the analysis themselves via SAP for Me. In either case, implementing application-level Security Notes is a chargeable Packaged Service, and testing those implementations remains the customer's responsibility.
This is exactly where the EPOS Security Notes App comes in. It automates the comparison of your system status against current notes - regardless of whether you have CAS packages - giving your team immediate clarity on where action is required.
Identifying which of the monthly SAP Security Notes are relevant to your specific landscape is your job. SAP will implement them on request, but the analytical burden sits with your team.
The SAP Security Notes App completes this analysis in minutes. You get an immediate, clear picture of what needs attention and can engage SAP for implementation with precision - rather than spending hours cross-referencing PDF lists.
One of the most important distinctions between running RISE and using the EPOS Suite is how work actually gets done. RISE Standard Services are largely ticket-based - meaning human interaction, waiting times, and rigid processes.
The EPOS Suite delivers genuine process automation. It operates as a Central Point of Management sitting above the RISE infrastructure, enabling your team to carry out tasks such as kernel updates, parameter changes, and system checks independently, consistently, and without delay.
And when issues do arise, the Empirius support team is always there to help.
RISE with SAP genuinely removes the burden of hardware and data center management - that is a real and meaningful advantage. But responsibility for the efficiency of your SAP business processes and the quality of your Basis operations stays with you.
The Empirius EPOS Suite is the strategic answer to this automation gap. It is the vendor-independent layer that brings your entire landscape - whether RISE, on-premise, or hybrid - under consistent, efficient control.
Let's take a look at which of your Excluded Tasks we can automate today.
No. While SAP takes on infrastructure and parts of the operational workload under RISE, the current Roles & Responsibilities Matrix (v.3.2026) confirms that 144 "Excluded Tasks" remain entirely the customer's responsibility. A capable SAP Basis team is still required to manage and oversee these tasks.
SAP Note 3375877 officially announces the end of maintenance for SAP Landscape Management (LaMa) 3.0, effective December 31, 2027. There is no direct on-premise or hybrid replacement from SAP. For customers relying on LaMa to automate their landscapes, this creates a significant automation gap — particularly given that the underlying responsibilities do not go away.
Excluded Tasks are the 144 activities (as of v.3.2026) that are not covered by any RISE service category - not Standard, Additional, Optional, or Packaged Services. The customer is 100% responsible for executing and managing these tasks independently.
SAP provides standard system refreshes as part of its Standard Services, but the surrounding steps are not included. Pre-processing tasks - such as exporting customer-specific configuration tables - and the logical integrity check after a restore are either chargeable Packaged Services or Excluded Tasks. Without automation tooling such as Empirius BlueCopy, the post-copy automation steps alone can take days rather than hours.
The full CSR process - obtaining a signed certificate from an external Certificate Authority - is an Excluded Task and sits entirely with the customer. Certificate validity monitoring is not a Standard Service; it must be purchased as a Packaged Service. The Empirius SAP Certificate Management App automates both monitoring and renewal proactively.
Security Note analysis is a Standard Service only for customers with Cloud Application Services (CAS) packages. Customers without CAS must conduct the analysis themselves via SAP for Me. In all cases, testing implemented notes remains the customer's responsibility. The EPOS Security Notes App automates the relevance check against your specific landscape, regardless of whether CAS packages are in place.
RISE Standard Services are largely ticket-based, which means human handoffs, waiting times, and fixed workflows. The EPOS Suite provides genuine process automation and acts as a Central Point of Management above the RISE infrastructure. It enables Basis teams to execute tasks such as kernel updates, parameter changes, and system checks independently, consistently, and without delay - across RISE, on-premise, and hybrid environments alike.
Talk to our experts
