GRS Domain 7: How to Score Your Data Extraction Compliance
Domain 7 of the Governance Readiness Score is where ODP-RFC exposure becomes measurable. Eight scored questions cover migration status, approved methods, the December 2026 deadline, audit evidence, Note 3439624, and patch posture — with a clear path from zero to a defensible compliance score.
December 2026 is a hard stop. The temporary ODP-RFC fallback expires with no extension. Domain 7 of the Governance Readiness Score exists so you can quantify — not guess — whether your extraction estate will survive that date.
Most organisations still talk about the ODP ban as a binary: are we broken or not? That framing is useless for a steering committee. You need a score — something an auditor, a CIO, and a BASIS lead can all read the same way.
That is what GRS Domain 7 — Data Extraction Compliance is for.
Domain 7 carries approximately 15% of the composite Governance Readiness Score in a standard assessment. It is not optional. It is not "nice to have after migration." It is the domain that tells you whether your data estate is still standing on a temporary fallback — or whether you have already moved to methods SAP will still allow after December 2026.
This post walks through every Domain 7 question, how scoring works, what evidence you need, and how to move from a failing score to a defensible one.
Where Domain 7 Sits in GRS
The Governance Readiness Score evaluates SAP-on-cloud readiness across up to nine domains. Domains 1–7 are always active. Domains 8 (ECC Migration Readiness) and 9 (Clean Core) activate when those programmes are in scope.
| Domain | Name | Category | Typical weight* |
|---|---|---|---|
| 1–3 | AI Sovereignty / Cost / Safety | AI Governance | ~17% / ~8% / ~8% |
| 4–6 | Integration Reliability / Observability / DR | Integration Governance | ~17% / ~10% / ~10% |
| 7 | Data Extraction Compliance | Data Governance | ~15% |
| 8 | ECC Migration Readiness | Conditional | absorbed when active |
| 9 | Clean Core Compliance | Conditional | absorbed when active |
*Weights renormalise when Domains 8/9 are included. Exact values come from the live engine at engine.skynome.com.
Important naming note: Early planning materials sometimes called this "Domain 9." In the shipped GRS model, extraction compliance is Domain 7. Domain 9 is Clean Core. If you see "Domain 9 extraction" in older decks, map it to Domain 7.
For a focused commercial engagement, Skynome's ODP Compliance Review template scores Domains 1, 2, and 7 — the minimum set that produces a useful extraction/governance signal without running a full nine-domain programme.
How Domain Scoring Works
Each Domain 7 question returns an option scored 0–4. The domain score is the average of answered questions, normalised to 0–100.
Rough interpretation:
| Domain score | Meaning |
|---|---|
| 80–100 | Extraction estate is largely compliant; December risk is controlled |
| 50–79 | Partial migration; December is achievable only with active programme management |
| 25–49 | Material exposure; fallback dependency is still carrying production |
| 0–24 | Critical — no credible path to December without emergency remediation |
Remediation priority inside GRS treats low Domain 7 answers as critical/high because the domain weight is material (≥15%). A zero on 7.1 or 7.3 is not a documentation gap — it is a production outage risk dated December 2026.
The Eight Questions — Scored
7.1 — Have all ODP-RFC pipelines been migrated since June 2026 enforcement?
Why it matters: June 9, 2026 activated the technical block behind SAP Note 3255746. ADF SAP CDC, Fivetran, Qlik Replicate, Talend, and Informatica paths that depended on ODP-RFC are either broken or running on fallback.
| Score | Answer |
|---|---|
| 4 | Fully migrated — zero ODP-RFC dependency |
| 2 | Migration in progress — on track for December |
| 1 | Still on fallback — no migration started |
| 0 | No plan |
Evidence: Pipeline inventory with method tags; linked-service configs; cutover tickets.
Remediation: Inventory every affected pipeline this week. For each, name owner, volume, and target method (RFC table read, OData, ABAP Push, DeltaQ, or certified partner). Do not wait for fallback expiry.
7.2 — What percentage of pipelines use SAP-approved extraction methods?
Why it matters: Compliance is not only "ODP off." It is "approved methods on." SAP-recognised patterns include Datasphere, SNP Glue, Theobald, Simplement, ASAPIO, OData, and Event Mesh — plus ABAP-native push over HTTPS, which does not use the banned ODP-RFC surface.
| Score | Answer |
|---|---|
| 4 | 100% |
| 3 | 75–99% |
| 2 | 50–75% |
| 1 | 25–50% |
| 0 | Under 25% |
Evidence: Method classification spreadsheet keyed to Note 3439624 output.
7.3 — Will migration complete before December 2026 fallback expiry?
Why it matters: The temporary fallback that re-enables ODP-RFC expires December 2026 with no extension. "We will figure it out in Q1 2027" is not a plan.
| Score | Answer |
|---|---|
| 4 | Complete — not dependent on fallback |
| 3 | On track — milestones aligned to December |
| 1 | Behind schedule — December at risk |
| 0 | No plan — will fail when fallback ends |
Evidence: Programme plan with milestone dates; RAG status to steering committee.
Suggested milestone skeleton: identify this week → choose replacements in 2 weeks → non-prod migrated in 30 days → production migrated by end of October → re-run Note 3439624 before December.
7.4 — Which SAP-approved methods are in use?
Why it matters: Single-method estates create concentration risk. Diversity of compliant methods is a resilience signal.
| Score | Answer |
|---|---|
| 4 | 3+ certified/approved methods active |
| 3 | 2 methods active |
| 2 | 1 method active |
| 1 | Planned, not deployed |
| 0 | None |
7.5 — Can you demonstrate Note 3255746 compliance in an audit?
Why it matters: When procurement, risk, or external audit asks "are you compliant?", "our pipelines seem fine" is not an answer.
| Score | Answer |
|---|---|
| 4 | Evidence pack assembled and validated |
| 2 | Position documented, not packaged |
| 0 | No evidence |
Minimum evidence pack:
- Complete pipeline inventory with extraction-method classification
- Migration plan execution evidence (tickets, cutover records)
- BASIS sign-off: no active ODP-RFC subscribers (post–Note 3439624)
- Legal/risk review of compliance position
Store it where it cannot quietly disappear — GRC repository, not a shared inbox.
7.6 — Is there policy enforcement stopping new ODP-RFC pipelines?
Why it matters: You can finish migration and still lose if a new ADF factory ships an ODP linked service next month.
| Score | Answer |
|---|---|
| 4 | Automated — CI/CD / templates block ODP connectors |
| 2 | Manual — architecture review board checks |
| 0 | None — new pipelines can reintroduce ODP-RFC |
Remediation: Scan ADF pipeline JSON for ODP-RFC linked service types; fail the deploy gate; add the same check to the ARB checklist.
7.7 — Has SAP Note 3439624 been run and documented?
Why it matters: Note 3439624 is SAP's own self-assessment. Without it, every other Domain 7 answer is guesswork.
| Score | Answer |
|---|---|
| 4 | Run + documented + remediated |
| 2 | Run + documented; remediation in progress |
| 1 | Run but undocumented |
| 0 | Not run |
If this question scores 0, stop the assessment theatre and run the note. It is usually under an hour of BASIS time.
7.8 — Is the June 2026 enforcement patch applied, or are you still on fallback?
Why it matters: Pre-patch systems can look "healthy" while still depending on a temporary mechanism that SAP will remove.
| Score | Answer |
|---|---|
| 4 | Patch applied + all pipelines migrated |
| 2 | Patch applied + migration in progress |
| 1 | Patch not applied — fallback in use |
| 0 | Unknown |
Order of operations: Run 3439624 → migrate or compensate → apply Support Package in DEV → validate → PROD → retain patch + validation evidence.
Worked Example: Three Score Profiles
Profile A — "Still on fallback"
Typical answers: 7.1=1, 7.2=0, 7.3=0, 7.4=0, 7.5=0, 7.6=0, 7.7=0, 7.8=1
Average ≈ 0.25 / 4 → ~6/100. Composite GRS will be dragged hard. December is an incident, not a milestone.
Profile B — "Programme alive, December tight"
Typical answers: 7.1=2, 7.2=2, 7.3=3, 7.4=2, 7.5=2, 7.6=2, 7.7=2, 7.8=2
Average ≈ 2.1 / 4 → ~53/100. Survivable if October production cutovers land. Needs weekly RAG.
Profile C — "Audit-ready"
Typical answers mostly 4s with 7.4=3
Average ≈ 3.7 / 4 → ~93/100. Evidence pack exists; CI blocks regressions; Note 3439624 re-run is scheduled.
How to Raise Domain 7 in 30 Days
Week 1 — See. Run Note 3439624. Classify Tier 1 / 2 / 3 pipelines. Confirm patch/fallback status (7.7, 7.8, 7.1).
Week 2 — Choose. Map each Tier 1 pipeline to a compliant method. Prefer durable patterns for high-volume ECC tables — often ABAP Push or certified partners; OData where semantic APIs exist; RFC table read only where volume and latency allow (ADF options comparison).
Week 3 — Move non-prod. Prove replacements. Stand up CI/ARB gates (7.6). Draft evidence pack skeleton (7.5).
Week 4 — Production cutovers begin. Lock December milestones (7.3). Re-score Domain 7. Brief steering committee with the before/after score, not a narrative alone.
Domain 7 vs the Rest of GRS
Domain 7 does not replace Domains 8 or 9. An organisation can score well on extraction and still fail ECC cutover readiness (Domain 8) or clean-core discipline (Domain 9). Conversely, a perfect S/4 programme that still depends on ODP-RFC fallback fails Domain 7 — and fails December.
Treat Domain 7 as the data-path compliance gate for everything else you are building on Azure, Fabric, or the lakehouse.
What Skynome Does With Domain 7
- ODP Compliance Review — Domains 1, 2, and 7 scored with remediation backlog and evidence-pack outline
- Full GRS — all domains, including ECC and Clean Core when in scope
- Live monitoring (roadmap) — re-score Domain 7 over time so December does not become a surprise
Start with a GRS assessment, or contact us for an ODP Compliance Review if December is already on your risk register.
Bottom Line
Domain 7 turns the ODP crisis into a number you can manage. Eight questions. Clear evidence. A December deadline that does not move. Run Note 3439624, score honestly, remediate in priority order — and treat any Domain 7 score below 50 as a programme emergency, not a documentation task.
How governed is your SAP estate?
The Governance Readiness Score measures your SAP on Azure environment across 9 domains — from AI sovereignty to data extraction compliance. Get your score.
Start Crisis Assessment