🔍 Read the full analysis: DORA, Operational Resilience, And The Auditor’s View Of SAP Takeovers on Rymvard
Get privacy and security gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
TL;DR
Rymvard says it added a per-system capacity check on October 4, 2026, to assess whether a secondary host can carry an SAP HANA production workload after a takeover. The early-access tool reports whether capacity fits, requires specified non-production systems to stop, falls short, or cannot be determined from current data; its example estate is illustrative, not a customer deployment.
Rymvard said on October 4, 2026, that its early-access capacity product now checks whether an SAP HANA secondary host can accommodate the primary system’s allocation after a takeover. The check is aimed at helping financial-sector service providers assess a specific recovery capacity question relevant to DORA, the EU’s digital operational resilience rules, but it is a product capability—not evidence that any customer has passed an audit or resilience test.
For each system running HANA system replication, the check compares the secondary host’s available capacity with the primary system’s allocation. Rymvard says the replica’s own allocation is replaced in the calculation. Test and development systems on the secondary host may be treated as stoppable to free capacity, while production systems belonging to other customers are not counted as stoppable.
Results fall into four categories: the system fits; it fits if named systems are stopped; it does not fit, with the shortfall reported in GiB; or the result is unknown. Rymvard says a replication status older than one hour or memory data older than 24 hours makes the result unknown rather than a pass. For scale-out systems, the assessment covers the system as a whole and uses the worst host pair.
The company says results can be exported for each system. It presents this as a way for a provider to document a takeover-capacity finding and address a shortfall—for example, when test systems have grown into memory needed by a replica—before a resilience test. The described Luxembourg managed-service-provider estate is an illustrative scenario; Rymvard says the screens are from its running product, not a customer estate, and imply no customer, site or outcome.
Operational Resilience / SAP HANA / October 2026
DORA, Operational Resilience, and the Auditor’s View of SAP Takeovers
Can the standby host carry production after a takeover? Rymvard says its early-access product now checks this capacity question for SAP HANA system replication. The feature can inform a recovery review; it is not proof of audit success or DORA compliance.
Takeover capacity, system by system
For each HANA system running system replication, the check compares the secondary host’s available capacity with the primary system’s allocation. In that calculation, the replica’s own allocation is replaced.
Primary allocation
Tests whether the designated secondary host can support the primary system’s allocation after takeover.
Named stoppages
Test and development systems may be treated as stoppable to free resources. Other customers’ production systems are not.
Whole system
For scale-out systems, the assessment covers the system as a whole and uses the worst host pair.
Four outcomes make uncertainty visible
A capacity result is useful only when its assumptions and data freshness are clear. Rymvard says stale information produces an unknown status rather than a pass.
Fits
Available capacity covers the primary allocation.
Fits if systems stop
Named non-production systems must stop to release capacity.
Does not fit
The shortfall is reported in GiB.
Unknown
Replication status or memory data is too old to support a finding.
Capacity evidence is one part of resilience
DORA (Regulation (EU) 2022/2554) has applied since January 17, 2025. It addresses ICT risk, including third-party services, and recovery testing for critical services. A per-system export may support review, but does not establish compliance or prove a successful recovery test.
What the export may help document
- Whether the standby allocation appears to fit.
- Which named non-production workloads would need to stop.
- Any reported capacity shortfall to address before a resilience test.
What it does not establish
- That failover execution or application behavior has been tested.
- Recovery time, every service dependency, or full service performance.
- That a financial entity meets all DORA duties or passed an audit.
A practical review path
The value of a capacity finding depends on current infrastructure data and how a provider incorporates it into documented controls and recovery planning.
Illustrative sequence, not a Rymvard product score or measured completion metric. A test system that has grown into memory needed by a replica is one example of a gap a provider could address.
Keep the example in context
Luxembourg provider estate
Rymvard’s public example describes a managed SAP provider serving financial services. The company says it is illustrative, not a customer deployment; no customer, site, or outcome is implied.
No audit outcome reported
Rymvard has not identified a customer using the feature or provided customer results, independent validation, or evidence of use in a formal DORA assessment.
What the announcement says
What was added?
A check of whether an SAP HANA secondary host can carry the primary system’s allocation after takeover. Rymvard says it was added to its early-access product on October 4, 2026.
How is capacity reported?
As fit, fit after named systems stop, does not fit with a GiB shortfall, or unknown when the available data is stale.
Does it certify DORA compliance?
No. The feature addresses one recovery-capacity question. It does not show that all obligations are met or that a recovery test succeeded.
Is the example a customer?
Rymvard describes the Luxembourg managed-provider estate as illustrative and says it does not represent a customer, site, or customer outcome.
Evidence for SAP Recovery Capacity
The check focuses on a concrete operational question: can the designated standby infrastructure support production after a failure or takeover? For financial entities that depend on managed SAP environments, an explicit capacity result may help teams identify whether recovery plans rest on available resources, require planned stoppages, or have a shortfall. An unknown status also matters: stale replication or memory information is not presented as evidence of readiness.
DORA has applied since January 17, 2025, and requires covered financial entities to manage ICT risk, including risks involving third-party providers, and to test the recovery of critical services. A per-system export could support operational review or provide material for an auditor to examine. It does not, by itself, establish compliance, prove that a recovery test succeeded, or replace the financial institution’s broader risk-management and testing obligations.
The distinction is relevant to customers as well as providers. A standby host can appear configured for replication while competing workloads affect the resources available at takeover. Showing which non-production systems would need to stop—and excluding other customers’ production workloads from that assumption—makes the capacity calculation more specific. The actual value of the feature will depend on current, accurate infrastructure data and how providers incorporate results into their documented controls.
As an affiliate, we earn on qualifying purchases.
DORA and HANA Replication
Regulation (EU) 2022/2554, commonly known as DORA, sets digital operational resilience requirements for financial entities. Its scope includes ICT risks associated with third-party services, which can make the resilience of outsourced systems relevant to regulated firms and their providers. The regulation has applied since January 17, 2025.
In a typical HANA system replication arrangement, a secondary site receives replicated data and may be used if the primary system becomes unavailable. Replication alone does not answer whether the secondary host has enough capacity to run the production allocation. Rymvard’s announced check is narrowly focused on that capacity question, rather than claiming to test every component of a recovery plan or the full performance of an SAP service.
Rymvard describes itself as a capacity ledger for data centers and says the feature is available in its early-access product. The company publishes no prices and says pricing is agreed with early-access partners. Its public example uses a managed SAP provider serving financial services in Luxembourg, but it does not identify this as a real customer deployment.
“A replication status older than one hour or a memory figure older than 24 hours makes the result unknown — never fine.”
— Rymvard
data center capacity management software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Customer Use and Audit Outcomes
Rymvard has not identified a customer using the feature or provided customer results, independent validation, or evidence that the check has been used in an audit or formal DORA assessment. Its Luxembourg scenario is explicitly illustrative, and no customer, site, or operational outcome is implied.
It is also unclear how early-access partners will use exported results in their controls, how often the underlying memory and replication data will be refreshed in live deployments, or how the tool accounts for capacity constraints beyond the described host allocation. Rymvard’s announcement describes a focused capacity check; it does not say that the product tests failover execution, application behavior, recovery times, or every dependency in a service.
SAP HANA standby host testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Early-Access Adoption and Testing
Rymvard says the feature is running in its early-access product and that pricing is agreed with early-access partners rather than publicly listed. The next evidence of its practical use would come from deployments showing how providers apply the result, address identified capacity gaps, and incorporate the export into recovery planning or testing.
Financial institutions and their service providers will still need to evaluate their own systems and DORA obligations. No customer rollout, independent assessment, or future product milestone has been announced in the information available here. Rymvard lists contact@rymvard.com for inquiries about early access.
Primary source: Regulation (EU) 2022/2554 (DORA) · via Rymvard
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Rymvard announce?
Rymvard says it added a check that assesses whether an SAP HANA secondary host can carry the primary system’s allocation after a takeover. The feature was added to its early-access capacity product on October 4, 2026.
How does the check report capacity?
It returns one of four outcomes: fits, fits after named systems stop, does not fit with a shortfall in GiB, or unknown. Rymvard says stale replication status or memory data produces an unknown result, not a pass.
Does this feature certify DORA compliance?
No such certification is claimed. The check addresses one aspect of recovery capacity; it does not establish that an institution meets all DORA requirements or that a recovery test has succeeded.
Is the Luxembourg provider a Rymvard customer?
Rymvard describes the Luxembourg managed-provider estate as an illustrative scenario. The company says the example does not represent a customer, site, or customer outcome.
Primary source: Regulation (EU) 2022/2554 (DORA) · via Rymvard
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
