- INSTALLATION 10.X
Since there are no specific limitations on either the OS or browsers from the GRC application side, the underlying NW Product Availability Matrix (PAM) serves as the necessary guidance for browser information. Go to SAP Netweaver and enter the Product Availability Matrix and search SAP Access Control 10.0 or 10.1.
What browsers and operating systems (OS) will work with GRC installations 10.0 & 10.1?-
- You cannot uninstall ABAP add-ons. Further restrictions that concern the upgrade and maintenance of your SAP system and that occur as a result of installing an add-on are described in release strategy note 1504132 .
Can we uninstall GRCPINW or GRCPIERP - All three products are bundled together; however, you should only activate the products that you intend to use as activation incurs cost.
Does the download media for Access Control contain all the necessary files for installing Process Control and Risk ManagementMake sure that you have installed the latest SPAM/SAINT update on your system. If a newer version is available on SAP Service Marketplace, import the new SPAM/SAINT update. Ensure that you have imported the latest kernel version into your system, latest R3trans and tp. If a newer version is available on SAP Service Marketplace, import the most recent kernel. For 10.0 plug-in installation notes for 700, 710, and 731 please review notes 1500689, 1503749, and 1731987.
What are prerequisites for installing GRC plug-ins and foundation packages?- To search for this file in the SAP Service Marketplace, follow the steps below:
Click here to be directed to the SAP support portal.
Navigate to Software Downloads > SAP Software Download Center > Expand Support Packages and Patches > Search for Software (far right of screen). In the Search Term field, enter SAP GRC AC PORTAL PI, and in Search Method change “All terms” to “Phrase”.
Where can I find the GRC Netweaver Portal Plug-in GRCPIEP on the SAP Service Marketplace?- To search for this file in the SAP Service Marketplace, follow the steps below:
Conduct upgrades and installations when no one is using the system. Stop all background jobs in the GRC system prior to installing the plug-ins since these jobs may call function modules in the back-end. Only the GRC function modules will be impacted during the installation, other non-GRC modules will not be affected.
Can we install plug-ins during production hours while other users are using the system? Will there be any impact?When installing GRC AC 10 on an existing Firefighter (SPM) 5.3 plug-in system it will not overwrite the existing /VIRSA* tables that already contain Firefighter information. Please understand that after installation, that the 5.3 version will no longer be supported. Troubleshooting will only be conducted on the AC 10 or 10.1 version after the installation.
Installing GRC AC 10.0 or 10.1 on a plug-in system with an existing installation of Firefighter (SPM) 5.3. Would like to know if existing /VIRSA* Firefighter (SPM) tables will be overwritten?GRC has a few customers who have installed Access Controls and Solution Manager on the same server. A couple things to note, and one is that if the Access Control implementation requires running risk analysis on users with a large number of authorizations and risks, it may result in performance issues. Performance will be impacted for all applications running on the server. In the event that the server crashes, both Solution Manager and Access Control will be unusable. Another thing to consider is that Access Controls and Solution Manager may have differing maintenance cycles.Please be aware of the risks associated with this set up.
We are considering installation of GRC Access Controls on Solution manager, and we would like to know if there will be any issues?The HANA plugin HCOGRCPI is a plugin for provisioning to HANA system and it must be installed on HANA Database. This installation won't replace ERP plugin packages GRCPINW and GRCPIERP. ERP on HANA will function similarly to MAXDB or ORA. For more details see 1971217. Please note that 1869912 is actively updated to remain current.
What do we need to install to integrate SAP HANA and GRC so that users can be provisioned and risk analysis can be executed against HANA?- Where can I find the installation requirements for AC 10 and 10.1?
Please ensure that Early Watch Alert is properly implemented in Solution Manager. For more information see attached SAP Note 1257308. Finally, open a CSS message under component SV-BO-REQ, and a dispatcher will pick up the message.
We would like an Early Watch check on our GRC installation. How can we set this up?What is the best practice recommendation for client selection during a GRC installation?
When the GRCFND_A package is installed the source client is 000. It is not necessary to do a client copy in Access Control 10.x only environments.
Can we install GRC 10.1 directly on Oracle?
GRC 10.1 is installed only on SAP Netweaver systems beginning with SAP_BASIS version 740. As for the database that works with SAP system, see the Product Availability Matrix to see which database versions are supported. GRC works with whatever databases NW 7.40 supports. Go to the Support Portal. Navigate to Release, Upgrade & Maintenance Info > Product Availability Matrix. Click on orange box labeled Enter the Product Availability Matrix. Click on Display all Product Versions. At the top is an open search field, enter SAP Access Control 10.1 and click on the results to view. Click on General Information > Related Product Versions. You will see a box labeled Required Product Versions. In that box scroll down to SAP NetWeaver 7.4, and click on it. In next screen, Click on Technical Release Information and you will see Database Platforms on the menu bar. Click on it. Here you see complete list of supported databases that work with NW 7.40 and hence GRC 10.1.
- MIGRATION 4.0 or 5.3 to 10.x
- Migrating VIRSA 4.0 to GRC 10.1, will VIRSA 4.0 still function after installation?
- Once the GRC 10.1 plugin is installed on the VIRSA 4.0 system, though the 4.0 product is still accessible and the data will still remain in the tables, it is no longer supported and it must be clear to your users and administrators that the 4.0 product is not to be used with the v10.1 plugin. Restrict access to the old transactions after the GRC 10.1 plug-ins are installed.
The Historical (transactional) data such as Dashboards Reports (Access Risk Analysis Reports), CUP requests, workflow structure, firefighter log report data, management report data, etc., are not migrated to 10.x. Only the Master Data such as Configuration and Parameters are migrated.
Below is the list of data that can be easily imported using the Migration tool from GRC 5.3 to GRC 10.0 or GRC 10.1. The Master Data column contains details of objects that can be exported and Transactional Data column contains details of objects that cannot be exported.
Component
Master Data
Transactional Data
GRC-SAC-ARA
Segregation of Duties (SoD) Rules
Management Reports
Business Units
Dashboard Reports
Mitigation Controls
Background Job Ids
Critical Roles and Profiles
Organisational Rules
Supplementary Rules
GRC-SAC-ARQ
Workflow Types
CUP requests
Initiators
Access Dashboard Reports
Approvers
CADs
Stages
Paths
Escalation Configuration
Escape Routes
Role Repository
GRC-SAC-BRM
Methodology Processes
Role mapping
Organization Value Mappings
Roles and its Attributes
Role Types
Naming Convention
Role Approvers
Role Custom fields
GRC-SAC-EAM
Firefighter User Based and Its Description
Firefighter Log Report
Firefighter Role Based and its Description
Notifications
Firefighter Object and Its Description
Session and System log report
Firefighter Owner and Its Description
Firefighter Controller and Description
Reason Code and Description
Migrating from 5.3 to 10.x. What data can be migrated?
- UPGRADE TO 10.X
- We are upgrading to 10.x, where can we find the GRC Sizing Guides?
Please click the link to find the Sizing Guide for GRC AC, PC, and RM 10.1, and here for 10.0. Alternately, follow path SAP Service Marketplace > Products > Performance and Scalability > Sizing > Sizing Guidelines > Analytics and add it to your browser favorites. The sizing information in the guide is intended as a guideline for initial sizing. It is not absolute and cannot include all possible use and load patterns of the SAP GRC Access Control Suite. We recommend starting with the initial sizing based upon rough estimates about the number of users.
We are in the process of upgrading AC 5.3 to AC 10.1, and would like to know if we can still use /VIRSA/VFAT (5.3 Firefighter) during the transition?
- Yes, but you may run into errors such as “No valid RFC Destination is defined in the Configuration table”. See note 2028892 to resolve any known issues. We recommend only using this during transition to new version, and 10.1 should be used once configuration is complete.
Upgraded NW 7.X system to EHP7 with VIRSA 530_700 and it removed 5.3 and added GRC 10 components. Is this normal?
- System upgrade will remove the 5.3 components, and add GRC 10.0 or GRC 10.1 components. As GRC 5.3 has its master data located in a JAVA based system, the system collected data from RTAs in the child systems. The 10.x plug-in GRCPINW will contain the function modules of 5.3, and GRCPIERP will contain the function modules of VIRSAHR. You can locate the /VIRSA/* function modules in any system which has GRCPINW installed. Please note that continued use of 5.3 with10.x plug-ins is meant to be a temporary solution during transition and cutover to AC 10.x.
- We are upgrading GRCPINW V1100_731 to SP10 and face an error. What is the fix for that?
a. Kindly import GRCPINW V1100_731 SP10 and SP11 (SAPK-11510INGRCPINW and SAPK-11511INGRCPINW) in the same queue to avoid some missing functionalities
in SP10. Customers who are already on SP10 for GRCPINW V1100_731, kindly upgrade to SP11.
- COMPATIBILITY RELATED TO AC 10.1:
- What Support Pack of AC 10.1 plugin component (GRCPINW) for NW 731(V1100_731) is compatible with GRCFND_A for V1100?
For GRCPINW, V1100_731 SP01 is compatible with GRCFND_A V1100 SP01 onwards just like the other AC 10.1 Plugins. Please refer to the section AC 10.1 in the excel attachment in the SAP Note 1352498 .
Is GRC 10.1 Plugin (GRCPINW/GRCPIERP for V1100) compatible with Access Control 5.3?
All GRC 10.1 Support Packages have 5.3 code included. Please refer to KBA Note 1590030 under the section AC 10.1 for details.
What are the Plugins that Access Control 10.1 (GRCFND_A V1100) is compatible with?
Access Control 10.1 GRCFND_A Package need to be installed on NW740 and it is compatible with GRCPINW (700, 710, 730 and 731). (Section 6 of SAP note 1680268 for details)
- COMPATIBILITY RELATED TO AC 10.0:
- For GRCPINW, V1000_731 SP00 is compatible with GRCFND_A V1000 SP09 onwards. (And GRCPINW V1000_731 SP01 is compatible with GRCFND_A V1000 SP10 and so on). Please refer to the section AC 10.0 in the excel attachment in the SAP Note 1352498 for details.
What SP of AC 10.0 GRCPINW for NW 731(V1000_731) is compatible with GRCFND_A for V1000? Is GRC 10.0 Plugin (GRCPINW/GRCPIERP for V1000) Compatible with Access Control 5.3?
Yes. The AC 10.0 Plug-in Support Pack 4 (SP04) contains the code which is of 5.3 VIRSANH SP16 and VIRSAHR SP14. Please refer to KBA Note 1590030 under the section AC 10.0 for details.
- What is the compatibility of GRCFND_A V1000 with NW releases?
- GRCFND_A is compatible with NW 702 SP06 (SAP_BASIS) onwards. GRCFND_A is also compatible with NW 7.31 from SP08 of GRCFND_A V1000. Please review the solution in Section 4 of SAP note 1680268 for details.
- Is the GRC 10.0 NW Plugin available for SAP NW 740?
- Yes. You can install GRCPINW V1000_731 on SAP NW 731 or higher. Please review SAP Note 1504132 for details.
- Is the GRC 10.0 NW Plugin available for SAP NW 750?
a. Yes. You can install GRCPINW V1000_700 SP24, V1000_710 SP24, V1000_731 SP15 or higher for NW 750. Please review SAP Note 2337236 for details.
- COMPATIBILITY RELATED TO AC 10.x (COMMON QUESTIONS):
- What is the GRC Plugin that is compatible with NW Portal 7.0x and 7.3+ and higher for Access Control 10.x?
- The Portal Plug-in is GRCPIEP. Please review KBA Note: 1977781 for details.
- Yes, you can connect to AC 10.0 Plug-in (GRCPINW & GRCPIERP) from AC 10.1 front-end as long as support pack of AC 10.0 plug-in is SP10 and above. However, some new AC 10.1 functionalities such as Organization Rule Wizard, Custom User group creation and EAM DB log collection will not work. Please review KBA Note 1590030 for details.
Is GRC 10.0 Plugin (GRCPINW/GRCPIERP for V1000) Compatible with Access Control 10.1 Foundation (GRCFND_A V1100)?- Is GRC 10.1 Plugin (GRCPINW/GRCPIERP for V1100) Compatible with Access Control 10.0 Foundation (GRCFND_A V1000)?
- Our recommendation is to upgrade both front-end (GRCFND_A) and back-end plug-in (GRCPINW & GRCPIERP) components to AC 10.1 which also contains the AC 5.3 RTA. During the time of transition, you can still connect to AC 10.1 Plug-in (SP04) (GRCPINW & GRCPIERP) from AC 10.0 front-end. Reference from KBA Note 1590030.
Is the GRC 10.0 Compatible with SAP ECC on HANA Platform?
Is the GRC 10.0 GRCFND_A compatible with SAP Netweaver ABAP 7.1?
- GRCFND_A 10.0 can only be installed on SAP NETWEAVER AS ABAP 7.02 SP06. This is the foundation package where configuration is maintained in IMG. Only add-ons GRCIERP and GRCPINW can be installed on SAP NETWEAVER AS ABAP 7.1 plug-in systems. For more information on GRC AC2010 compatibility please visit the Product Availability Matrix on the SAP Service Marketplace. Reference SAP Note 1648030.
- Is the GRC 10.x GRCFND_A compatible with SAP Netweaver ABAP 7.5?
- Yes. Now SAP NETWEAVER ABAP 7.50 is also compatible with GRC 10.0 release and GRC 10.1 release. Reference SAP Note 2156130
- Yes. Now SAP NETWEAVER ABAP 7.50 is also compatible with GRC 10.0 release and GRC 10.1 release. Reference SAP Note 2156130
- COMPATIBILITY RELATED TO AC 5.3:
- Is there an AC 5.3 RTA Compatible with NW 731(EHP 6- Enhancement Pack 06)?
Yes. You cannot use the VIRSANH 530_700 package (for SAP NW 731 System). You will have to install the VIRSANH 530_731. Please review Section 2 in the solution of SAP Note 1680268 .
Are the Access Control 5.3 fixes included in the Access Control 10.0 and 10.1 Plugins?
- Yes. 10.1 plug-in contains 5.3 SP16 VIRSANH and has been validated against GRC 5.3 SP15, not higher. It will only contain critical fixes for 5.3 after SP15.
- Is there a note specifying the compatibility of AC 5.3 on SAP Netweaver Java 7.0x?
- Please review SAP Note 1433940 - Access Control compatibility on Netweaver Java server 7.01/7.02
- Is the GRC AC 5.3 Plugin compatible with the SAP_BASIS 740 Release?
- Yes. Please review SAP Note 1918850 for details.
- VIREPRTA_530_730 supported for NW 740? Is there a Portal Plugin for AC 5.3 in SAP NW 740 or is
- As mentioned in SAP Note 1850345, we see that the successor is AC 10.1 for AC 5.3. That means we do not support ‘530 portal plugin in 740’.The following Add-Ons are not planned to be released, but a compatible successor does exist: SAP GRC ACCESS CONTROL 5.3 => successor: SAP GRC ACCESS CONTROL 10.1
- BACKWARD COMPATIBILITY:
Has backward compatibility been introduced with GRC Access Control 10.0?
Prior to GRCFND_A SP10, the GRC system and all plug-in systems must be on the same support pack level. As of GRCFND_A SP10, backward compatibility has been introduced. Please refer to SAP Note 1821368 for more details.
Does backward compatibility also work with GRC 10.1?
- For GRC 10.1 Foundation and GRC 10.1 Plugin systems, it is recommended to have both systems at the same level, however GRCFND_A 10.1 will be compatible with all 10.1 plugins as long as the plugin Support Pack level is equal to or lower than the Foundation. (For example; GRCFND_A cannot be on SP02 while the plugin is on SP04).
Is there a note detailing the downward compatibility or Support Pack Numbering between the GRC (Front End) and the GRC Plugin (RTA)?
Yes, there is one common note that details this information on all GRC Releases starting from AC 4.0 through AC 5.x through AC 10.x. Please review SAP Note 1352498 for the details.
What is the compatibility of Access Control Plugin Packages with SAP NW 730 and SAP NW 711?
Access Control Plug-in
SAP NW 711
SAP NW 730
VIRSANH/VIRSAHR
VIRSANH and VIRSAHR is compatible with NW 711 after implementation of 1675165 note.
SAP NW 730 is compatible with VIRSANH/VIRSAHR SP17 onwards.
GRCPINW/GRCPIERP
SAP NW 730 is compatible with GRCPINW/GRCPIERP SP05 onwards.
Please review the solution in Section 5 of SAP note 1680268 for details.
- Is there any known compatibility issue of Access Control on IE11?
- GRC supports all browsers that SAP Netweaver supports, then write. You can check the NW compatibility with the browsers on the Product Availability Matrix at http://service.sap.com/pam. For IE 11 specifically, please review the solution in KBA Note 2205512.