Governance, Risk and Compliance
Page tree
Skip to end of metadata
Go to start of metadata
Table of Contents

  • INSTALLATION 10.X 
     
    1. What browsers and operating systems (OS) will work with GRC installations 10.0 & 10.1?

      1. Since there are no specific limitations on either the OS or browsers from the GRC application side, the underlying NW Product Availability Matrix (PAM) serves as the necessary guidance for browser information. Go to SAP Netweaver and enter the Product Availability Matrix and search SAP Access Control 10.0 or 10.1. 

    2.   Can we uninstall GRCPINW or GRCPIERP
      1. You cannot uninstall ABAP add-ons. Further restrictions that concern the upgrade and maintenance of your SAP system and that occur as a result of installing an add-on are described in release strategy note 1504132 .
    3. Does the download media for Access Control contain all the necessary files for installing Process Control and Risk Management
      1. All three products are bundled together; however, you should only activate the products that you intend to use as activation incurs cost.
    4. What are prerequisites for installing GRC plug-ins and foundation packages?

      1. Make sure that you have installed the latest SPAM/SAINT update on your system. If a newer version is available on SAP Service Marketplace, import the new SPAM/SAINT update. Ensure that you have imported the latest kernel version into your system, latest R3trans and tp. If a newer version is available on SAP Service Marketplace, import the most recent kernel. For 10.0 plug-in installation notes for 700, 710, and 731 please review notes 1500689, 1503749, and 1731987.

    5. Where can I find the GRC Netweaver Portal Plug-in GRCPIEP on the SAP Service Marketplace?
      1. To search for this file in the SAP Service Marketplace, follow the steps below:

        1. Click here to be directed to the SAP support portal.

        2. Navigate to Software Downloads > SAP Software Download Center > Expand Support Packages and Patches > Search for Software (far right of screen).  In the Search Term field, enter SAP GRC AC PORTAL PI, and in Search Method change “All terms” to “Phrase”.

    6. Can we install plug-ins during production hours while other users are using the system? Will there be any impact?

      1. Conduct upgrades and installations when no one is using the system.  Stop all background jobs in the GRC system prior to installing the plug-ins since these jobs may call function modules in the back-end. Only the GRC function modules will be impacted during the installation, other non-GRC modules will not be affected.

    7. Installing GRC AC 10.0 or 10.1 on a plug-in system with an existing installation of Firefighter (SPM) 5.3.  Would like to know if existing /VIRSA* Firefighter (SPM) tables will be overwritten?

      1. When installing GRC AC 10 on an existing Firefighter (SPM) 5.3 plug-in system it will not overwrite the existing /VIRSA* tables that already contain Firefighter information.  Please understand that after installation, that the 5.3 version will no longer be supported.  Troubleshooting will only be conducted on the AC 10 or 10.1 version after the installation.

    8. We are considering installation of GRC Access Controls on Solution manager, and we would like to know if there will be any issues?

      1. GRC has a few customers who have installed Access Controls and Solution Manager on the same server.  A couple things to note, and one is that if the Access Control implementation requires running risk analysis on users with a large number of authorizations and risks, it may result in performance issues.  Performance will be impacted for all applications running on the server.  In the event that the server crashes, both Solution Manager and Access Control will be unusable. Another thing to consider is that Access Controls and Solution Manager may have differing maintenance cycles.Please be aware of the risks associated with this set up.

    9. What do we need to install to integrate SAP HANA and GRC so that users can be provisioned and risk analysis can be executed against HANA?

      1. The HANA plugin HCOGRCPI is a plugin for provisioning to HANA system and it must be installed on HANA Database. This installation won't replace ERP plugin packages GRCPINW and GRCPIERP.  ERP on HANA will function similarly to MAXDB or ORA.  For more details see 1971217.  Please note that 1869912 is actively updated to remain current.

    10. Where can I find the installation requirements for AC 10 and 10.1?

      1. Go to SAP Service Marketplace > Products > Installation & Upgrade Guides > Analytics > Governance, Risk, and Compliance > Access Control, and you’ll find Installation Guide - SAP Access Control 10.0 here and Installation Guide - SAP Access Control 10.1 here .

    11. We would like an Early Watch check on our GRC installation.  How can we set this up?

      1. Please ensure that Early Watch Alert is properly implemented in Solution Manager.  For more information see attached SAP Note 1257308.  Finally, open a CSS message under component SV-BO-REQ, and a dispatcher will pick up the message.

    12. What is the best practice recommendation for client selection during a GRC installation?

      1. When the GRCFND_A package is installed the source client is 000.  It is not necessary to do a client copy in Access Control 10.x only environments.

    13. Can we install GRC 10.1 directly on Oracle?

      1. GRC 10.1 is installed only on SAP Netweaver systems beginning with SAP_BASIS version 740. As for the database that works with SAP system, see the Product Availability Matrix to see which database versions are supported.  GRC works with whatever databases NW 7.40 supports. Go to the Support Portal.  Navigate to Release, Upgrade & Maintenance Info > Product Availability Matrix. Click on orange box labeled Enter the Product Availability Matrix. Click on Display all Product Versions.  At the top is an open search field, enter SAP Access Control 10.1 and click on the results to view. Click on General Information > Related Product Versions.  You will see a box labeled Required Product Versions.  In that box scroll down to SAP NetWeaver 7.4, and click on it. In next screen, Click on Technical Release Information and you will see Database Platforms on the menu bar.  Click on it.  Here you see complete list of supported databases that work with NW 7.40 and hence GRC 10.1. 

         

    • MIGRATION 4.0 or 5.3 to 10.x
    1.   Migrating VIRSA 4.0 to GRC 10.1, will VIRSA 4.0 still function after installation?
      1.  Once the GRC 10.1 plugin is installed on the VIRSA 4.0 system, though the 4.0 product is still accessible and the data will still remain in the tables, it is no longer supported and it must be clear to your users and administrators that the 4.0 product is not to be used with the v10.1 plugin.  Restrict access to the old transactions after the GRC 10.1 plug-ins are installed.
    2. Migrating from 5.3 to 10.x.  What data can be migrated?

      1. The Historical (transactional) data such as Dashboards Reports (Access Risk Analysis Reports), CUP requests, workflow structure, firefighter log report data, management report data, etc., are not migrated to 10.x.  Only the Master Data such as Configuration and Parameters are migrated. 

      2. Below is the list of data that can be easily imported using the Migration tool from GRC 5.3 to GRC 10.0 or GRC 10.1. The Master Data column contains details of objects that can be exported and Transactional Data column contains details of objects that cannot be exported.  

           Component

          Master   Data

              Transactional Data

         

         

         

        GRC-SAC-ARA  

            Segregation of Duties (SoD)  Rules   

              Management Reports

         

          Business   Units

              Dashboard Reports

         

            Mitigation Controls

              Background Job Ids

         

            Critical Roles and Profiles

         

         

            Organisational Rules

         

         

            Supplementary Rules

         

         

         

         

         

         

         

        GRC-SAC-ARQ

            Workflow Types 

              CUP requests

         

            Initiators 

              Access Dashboard Reports 

         

            Approvers 

         

         

            CADs 

         

         

            Stages 

         

         

            Paths 

         

         

            Escalation Configuration 

         

         

            Escape Routes 

         

         

          Role   Repository 

         

         

         

         

        GRC-SAC-BRM

         Methodology   Processes

         

         

         Role   mapping

         

         

         Organization   Value Mappings

         

         

         Roles   and its Attributes

         

         

         Role   Types

         

         

         Naming   Convention

         

         

         Role   Approvers

         

         

         Role   Custom fields

         

         

         

         

        GRC-SAC-EAM

        Firefighter   User Based and Its Description  

            Firefighter Log Report 

         

        Firefighter   Role Based and its Description

            Notifications

         

         

         

         

        Firefighter   Object and Its Description

            Session and System log report 

         

        Firefighter   Owner and Its Description

         

         

        Firefighter   Controller and Description

         

         

        Reason   Code and Description

         

                     

    • UPGRADE TO 10.X
    1. We are upgrading to 10.x, where can we find the GRC Sizing Guides?

      1.  Please click the link to find the Sizing Guide for GRC AC, PC, and RM 10.1, and here for 10.0.  Alternately, follow path SAP Service Marketplace > Products > Performance and Scalability > Sizing > Sizing Guidelines > Analytics and add it to your browser favorites. The sizing information in the guide is intended as a guideline for initial sizing.  It is not absolute and cannot include all possible use and load patterns of the SAP GRC Access Control Suite.  We recommend starting with the initial sizing based upon rough estimates about the number of users.

    2. We are in the process of upgrading AC 5.3 to AC 10.1, and would like to know if we can still use /VIRSA/VFAT (5.3 Firefighter) during the transition?

      1. Yes, but you may run into errors such as “No valid RFC Destination is defined in the Configuration table”.  See note 2028892 to resolve any known issues.  We recommend only using this during transition to new version, and 10.1 should be used once configuration is complete.

    3. Upgraded NW 7.X system to EHP7 with VIRSA 530_700 and it removed 5.3 and added GRC 10 components.  Is this normal?

      1. System upgrade will remove the 5.3 components, and add GRC 10.0 or GRC 10.1 components.  As GRC 5.3 has its master data located in a JAVA based system, the system collected data from RTAs in the child systems. The 10.x plug-in GRCPINW will contain the function modules of 5.3, and GRCPIERP will contain the function modules of VIRSAHR.  You can locate the /VIRSA/* function modules in any system which has GRCPINW installed.  Please note that continued use of 5.3 with10.x plug-ins is meant to be a temporary solution during transition and cutover to AC 10.x.  
    4.   We are upgrading GRCPINW V1100_731 to SP10 and face an error. What is the fix for that?
              a.  Kindly import GRCPINW V1100_731 SP10 and SP11 (SAPK-11510INGRCPINW and SAPK-11511INGRCPINW) in the same queue to avoid some missing functionalities 
                   in SP10. Customers who are already on SP10 for GRCPINW V1100_731, kindly upgrade to SP11.
        

 

  • COMPATIBILITY RELATED TO AC 10.1:
  1. What Support Pack of AC 10.1 plugin component (GRCPINW) for NW 731(V1100_731) is compatible with GRCFND_A for V1100? 

    1. For GRCPINW, V1100_731 SP01 is compatible with GRCFND_A V1100 SP01 onwards just like the other AC   10.1 Plugins.  Please refer to the section AC 10.1 in the excel attachment in the SAP Note  1352498 .

  2. Is GRC 10.1 Plugin (GRCPINW/GRCPIERP for V1100) compatible with Access Control 5.3?

    1. All GRC 10.1 Support Packages have 5.3 code included. Please refer to KBA Note 1590030 under the section AC 10.1 for details.  

  3. What are the Plugins that Access Control 10.1 (GRCFND_A V1100) is compatible with?

    1. Access Control 10.1 GRCFND_A Package need to be installed on NW740 and it is compatible with GRCPINW (700, 710, 730 and 731). (Section 6 of SAP note 1680268 for details)  

  • COMPATIBILITY RELATED TO AC 10.0:
  1. What SP of AC 10.0 GRCPINW for NW 731(V1000_731) is compatible with GRCFND_A for V1000? 
    1. For GRCPINW, V1000_731 SP00 is compatible with GRCFND_A V1000 SP09 onwards. (And GRCPINW V1000_731 SP01 is compatible with GRCFND_A V1000 SP10 and so on). Please refer to the section AC 10.0 in the excel attachment in the SAP Note 1352498 for details.

  2. Is GRC 10.0 Plugin (GRCPINW/GRCPIERP for V1000) Compatible with Access Control 5.3?

    1. Yes. The AC 10.0 Plug-in Support Pack 4 (SP04) contains the code which is of 5.3 VIRSANH SP16 and VIRSAHR SP14.  Please refer to KBA Note 1590030 under the section AC 10.0 for details.  

  3. What is the compatibility of GRCFND_A V1000 with NW releases?
    1. GRCFND_A is compatible with NW 702 SP06 (SAP_BASIS) onwards. GRCFND_A is also compatible with NW 7.31 from SP08 of GRCFND_A V1000. Please review the solution in Section 4 of SAP note 1680268 for details.  
  4. Is the GRC 10.0 NW Plugin available for SAP NW 740?
    1. Yes. You can install GRCPINW V1000_731 on SAP NW 731 or higher. Please review SAP Note 1504132 for details.  
  5.   Is the GRC 10.0 NW Plugin available for SAP NW 750?
            a. Yes. You can install GRCPINW V1000_700 SP24, V1000_710 SP24, V1000_731 SP15 or higher for NW 750. Please review SAP Note 2337236 for details.

 

  • COMPATIBILITY RELATED TO AC 10.x (COMMON QUESTIONS):
  1.   What is the GRC Plugin that is compatible with NW Portal 7.0x and 7.3+ and higher for Access Control 10.x?
    1. The Portal Plug-in is GRCPIEP. Please review KBA Note: 1977781 for details.
  2. Is GRC 10.0 Plugin (GRCPINW/GRCPIERP for V1000) Compatible with Access Control 10.1 Foundation (GRCFND_A V1100)?
    1. Yes, you can connect to AC 10.0 Plug-in (GRCPINW & GRCPIERP) from AC 10.1 front-end as long as support pack of AC 10.0 plug-in is SP10 and above.  However, some new AC 10.1 functionalities such as Organization Rule Wizard, Custom User group creation and EAM DB log collection will not work. Please review KBA Note 1590030 for details.  
  3.   Is GRC 10.1 Plugin (GRCPINW/GRCPIERP for V1100) Compatible with Access Control 10.0 Foundation (GRCFND_A V1000)?
    1. Our recommendation is to upgrade both front-end (GRCFND_A) and back-end plug-in (GRCPINW & GRCPIERP) components to AC 10.1 which also contains the AC 5.3 RTA. During the time of transition, you can still connect to AC 10.1 Plug-in (SP04) (GRCPINW & GRCPIERP) from AC 10.0 front-end. Reference from KBA Note 1590030.  

  4. Is the GRC 10.0 Compatible with SAP ECC on HANA Platform?

    1. GRC 10.0 supports SAP ECC system on HANA platform. For implementing it, we need to have corresponding plug-In component i.e. GRCPINW V1000_731 with minimum SP04 level on SAP ECC system. Reference SAP Notes: 1971903 and 1812713 .

  5. Is the GRC 10.0 GRCFND_A compatible with SAP Netweaver ABAP 7.1?

    1. GRCFND_A 10.0 can only be installed on SAP NETWEAVER AS ABAP 7.02 SP06.  This is the foundation package where configuration is maintained in IMG. Only add-ons GRCIERP and GRCPINW can be installed on SAP NETWEAVER AS ABAP 7.1 plug-in systems. For more information on GRC AC2010 compatibility please visit the Product Availability Matrix on the SAP Service Marketplace. Reference SAP Note 1648030.   
  6. Is the GRC 10.x GRCFND_A compatible with SAP Netweaver ABAP 7.5?
    1. Yes. Now SAP NETWEAVER ABAP 7.50 is also compatible with GRC 10.0 release and GRC 10.1 release. Reference SAP Note  2156130          
       
  • COMPATIBILITY RELATED TO AC 5.3:  
  1. Is there an AC 5.3 RTA Compatible with NW 731(EHP 6- Enhancement Pack 06)?

    1. Yes. You cannot use the VIRSANH 530_700 package (for SAP NW 731 System). You will have to install the VIRSANH 530_731. Please review Section 2 in the solution of SAP Note 1680268 .

  2. Are the Access Control 5.3 fixes included in the Access Control 10.0 and 10.1 Plugins?

    1. Yes. 10.1 plug-in contains 5.3 SP16 VIRSANH and has been validated against GRC 5.3 SP15, not higher. It will only contain critical fixes for 5.3 after SP15.  
  3. Is there a note specifying the compatibility of AC 5.3 on SAP Netweaver Java 7.0x?
    1. Please review SAP Note 1433940 - Access Control compatibility on Netweaver Java server 7.01/7.02
  4. Is the GRC AC 5.3 Plugin compatible with the SAP_BASIS 740 Release?
    1. Yes. Please review SAP Note 1918850 for details.   
  5.       Is there a Portal Plugin for AC 5.3 in SAP NW 740 or is VIREPRTA_530_730 supported for NW 740?
    1. As mentioned in SAP Note 1850345, we see that the successor is AC 10.1 for AC 5.3. That means we do not support ‘530 portal plugin in 740’.The following Add-Ons are not planned to be released, but a compatible successor does exist: SAP GRC ACCESS CONTROL 5.3 => successor: SAP GRC ACCESS CONTROL 10.1
  • BACKWARD COMPATIBILITY:  

  1. Has backward compatibility been introduced with GRC Access Control 10.0?

    1. Prior to GRCFND_A SP10, the GRC system and all plug-in systems must be on the same support pack level. As of GRCFND_A SP10, backward compatibility has been introduced. Please refer to SAP Note 1821368 for more details.

  2. Does backward compatibility also work with GRC 10.1?

    1. For GRC 10.1 Foundation and GRC 10.1 Plugin systems, it is recommended to have both systems at the same level, however GRCFND_A 10.1 will be compatible with all 10.1 plugins as long as the plugin Support Pack level is equal to or lower than the Foundation. (For example; GRCFND_A cannot be on SP02 while the plugin is on SP04).

  3. Is there a note detailing the downward compatibility or Support Pack Numbering between the GRC (Front End) and the GRC Plugin (RTA)?

    1. Yes, there is one common note that details this information on all GRC Releases starting from AC 4.0 through AC 5.x through AC 10.x. Please review SAP Note 1352498 for the details.

  4. What is the compatibility of Access Control Plugin Packages with SAP NW 730 and SAP NW 711?

    1. Access Control Plug-in

      SAP   NW 711

      SAP   NW 730

      VIRSANH/VIRSAHR

      VIRSANH   and VIRSAHR is compatible with NW 711 after implementation of 1675165 note.

      SAP   NW 730 is compatible with VIRSANH/VIRSAHR SP17 onwards.

      GRCPINW/GRCPIERP

       

      SAP   NW 730 is compatible with GRCPINW/GRCPIERP SP05 onwards.

      Please review the solution in Section 5 of SAP note 1680268 for details.

  5. Is there any known compatibility issue of Access Control on IE11?
    1. GRC supports all browsers that SAP Netweaver supports, then write. You can check the NW compatibility with the browsers on the Product Availability Matrix at http://service.sap.com/pam. For IE 11 specifically, please review the solution in KBA Note 2205512.

 

 

 

  • No labels