Compliance Calibrator v4.0 - Cross System SoD Analysis

Hi all,
I'm looking to run SoD analysis across BI7 and ERP using Compliance Calibrator v4.0. I can see the Parameter in the config overview, and have set it to yes is both systems. But there is nothing else in the documentation as to what other config etc is needed. Does anyone now the steps involved or could you point me in the direction of documentation.
Thanks in advance,
Fiona

Hi,
there is a difference only if you have created and assigned mitigation controls to users.
In that case, you can decide to see the report of SOD conflicts with or without mitigation controls:
- Either you see all SOD conflicts including these that are mitigated (it is however clearly stated in the report whether a mitigation control exists or not)
- Or you see all SOD conflicts excepted these that are mitigated (we consider thus that mitigated conflicts should not appear in the report)
Rgds,
Karim

Similar Messages

AE 5.2 cross system risk analysis with CC 4.0

Hi,
We have an unique situation.
We have CC 4.0 (central) set up in ECC system where the rules and risks are defined for systems such as R/3, HR and SRM
We need AE to use this central CC system to do the risk analysis when an access request for HR or SRM is submitted in AE 5.2. Right now for a request to a HR system, risk analysis is being done in HR system where there are no rules and hence no risks are identified.
Environment :
CC 4.0 in ECC 5.0 with VIRSANH RTA 520_640 Level 3 and VIRSAHR RTA 520_640 Level 2
AE 5.2 JAVA in NW 7.0 SP level 2
Risk analysis for Access requests to ECC system is done with out any issues and the connectors in AE are defined as well as CC 4.0 configuration for cross system is enabled.
Please give your suggestions and also tell me if this below scenario is possible.
Use CC 5.2 Java stand alone system and define logical/cross system to connect to multiple systems such as HR and SRM and use those specific rules to do the risk analysis.
Thanks

Hi RM,
You can setup Risk Analysis inside AE Configuration.
You can identify the level of risk analysis and specify the Compliance Calibrator version for processing risks.
See the details from the AE Configuration Manual
In the Select Compliance Calibrator Version pane, from the Version drop-down list, select the version of Compliance Calibrator.
In the URI field, enter the appropriate URI address for the web services.
In the User Name field, enter your User ID. Your User ID must have security access
to web service.
In the Password field, type your password.
Select the Perform Org Rule Analysis option to perform org. rule analysis at risk
analysis time.
Note: There are two selectable versions of Compliance Calibrator. If you select 5.0 Web Service, three additional fields appear (URI, User Name, and Password). For the URI field, you need to navigate to the
SAP NetWeaver Web Application Server Home page > Web Services Navigator > CCRiskAnalysisService > WSDLs > Standard link of Document, where you will see a list of all web
services in the server. Select the desired URI address.
If you select Compliance Calibrator 4.0, there is no need to connect to a URI address
So the answer is YES, you can connect AE 5.2 with CC 4.0 for Risk Analysis.
Hope this helps,
Regards,
Kiran Kandepalli.

Cross system SOD check

Hi All,
We have SAP Compliance Calibrator by Virsa Systems Release 4.0 . One of the clients does not have Virsa installed and we need to check for user and role SOD conflicts in this client. Please advice what are the settings required for cross system connections and how to run the reports for remote checks. Also, will this affect any existing settings / setup?
Many thanks
Vijaya

Vijaya,
As far as I know, you will need CC 4.0 RTA installed on every system. Please open a message with SAP and check with them. Most of the customers have moved to RAR 5.3 which is the latest and advanced version of CC 4.0 and I will recommend you to upgrade to RAR 5.3.
Regards,
Alpesh

Compliance Calibrator for multiple SAP systems

I was wondering if anyone could assist me with my query. We are currently performing an implementation of Virsa CC for a client and have begun to configure a CC DEV system they have installed with their custom SoD rule set. The DEV CC system (sitting on a stand alone NetWeaver box) is "connected" to four SAP systems (DEV, QA, HR DEV & HR QA). When we are building "functions" (i.e. raise purchase orders) in CC it asks us to define a SAP system when we are entering the transaction codes. We've been configuring the functions with SAP DEV as the system, however when we run the analysis of results we would like to get results from QA as well. It appears that the risk analysis only works for the system that you have defined the functions in (i.e. we get results for users in DEV but not for users in QA).
My questions are as follows:
- Do you need to define all the systems you wish to run a risk analysis for within the function (i.e. function = Raise purchase orders. DEV ME21 & QA ME21)?
- If so, is there an easy way to convert our functions so that they point to QA as well (we've noticed that we can't edit the SAP system once the function is saved)?
- Is it possible to export the functions and then define the SAP system when importing them back into CC (we've noticed with the SAP delivered rule set that SAP DEV was automatically defaulted)? This is particularly relevant as we would like to export the rules from the DEV CC system and import them to the PROD CC system without having to manually create the rule set again; and
- Is it possible to export the rules and manually change the SAP system reference and import them back into CC (i.e. do a "replace all" DEV to QA)?
Any help would be greatly appreciated.
Thanks,
Alexi

In order to perform what your are trying to do in CC 5.2, you will need to go to configuration and setup a logical system, such as SAP R/3 and define all the appropriate systems for the logical system. Then, when modifying the functions, you will need to set the tcode (action) to the logical system defined, such as R/3 or APO, etc.
The cross-system functionality only comes into play if you want to analyze the SOD where a conflict would occur if a user had access to one function in one system (for example - purchase order processing in APO) and a conflicting function in a different system (for example - Vendor Master in R/3).
If you simply want to check who has violates a risk against multiple system - the logical system is the best way. You can have an logical system by system type - R/3, BW, APO, SRM, etc.
To convert this over, you can export the rules and during the export you have to define the new system when exporting the file. If that doesn't work, I'd just delete everything out, and use the upload files to reload the rules with the correct data.

Compliance Calibrator Issue with Backend system

Hi Experts,
We have situation where we are unable to run any risk analysis from CC to our backend system.
The error we are getting is " Can not execute BAPI USERLIST, Invalid value in OPTION field of value table for IN itab operator"
and the RFC ID in R/3 system is getting below dump
" The current ABAP/4 program attempted to execute an ABAP/4 Open SQL
statement in which the WHERE condition contains an IN itab operator.
The IN itab operator is used with internal tables which
have the following structure:
SIGN(1) OPTION(2) LOW LIKE db_field HIGH LIKE db_field
The OPTION column should contain only one of the following values:
"EQ LE GE CP BT NE LT GT NP NB"
The value "##" is not allowed here."
The functin module is /VIRSA/ZCC_GET_USER_LIST
Recently we have upgraded our R/3 system to ECC6.0, after upgrade we are geting this error.
Please help us.
Thank you.

"Recently we have upgraded our R/3 system to ECC6.0, after upgrade we are geting this error."
During upgrade, what method (process) you followed to upgrade VIRSANH ? What is version of VIRSANH , is it 5.3?
Earliar was it VIRSA or VIRSANH installed on your system?
Do you also have SAP_HR component?
regards,
Surpreet

Convert from Compliance Calibrator 4.0 to Risk Analysis and Remediation 5.2

Hello Forum,
I'm looking for other opinions on converting Compliance Calibrator (CC) 4.0 to Risk Analysis and Remediation (RAR) 5.2 (formerly CC)
I have inherited responsibility for RAR and need to upgrade it to the 5.2 level; our current ECC level prevents us from going to 5.3
I found a process that will unload the data from CC 4.0 and be imported into RAR 5.2
I want to understand the definitions that comprise the RAR and was thinking about recreating the definitions in 5.2 based on what is already defined in the CC 4.0 system; I have time to do this since there is no definitive deadline that would make it impossible to meet
Currently, I have the following definitions:
Business Process 6 entries
Functions 47 entries
Risks 147 entries
Mitigating Controls 40 entries
Would others find this approach acceptable and reasonable even though I would be entering all the information? Basically, it would be like defining the data for the very first time if this was NEW software
I would expect to come away with a good understanding of how everything ties together; at this point, I am only looking to create the necessary data that would allow for producing SOD reports that show all users with "risks" have been mitigated with acceptable controls
Thanks for your responses in advance
Jerry
Ryerson, Inc
630-758-2021

Thanks for the reply
I have the migration guide and have reviewed it; I have actually played around a bit with obtaining the file from CC 4.0; I found that the data records may need some adjustments to be compatible with RAR 5.2; one of the reasons that may be leading me to do everything from scratch
The definitions currently defined were completed by an outside source and the mitigated controls were defined by the Internal Audit area
I'm not sure if they were mixed with the defaults
I'm not sure at this point what impact or changes I would experience if I use the "default" supplied rules set but I expect to find out
Thanks again for your reply
Jerry

Re: Virsa Compliance Calibrator & Pre-defined SOD Rule Set

Hi All,
We have installed the Virsa Compliance calibrator 5.1 in our sandbox environment. When we goto the "Rule Architect" tab under Compliance calibrator using tcode /virsa/zvrat it brings up the page with Rules information.
Per the Virsa documents that i read they have mentioned that there are pre-defined SOD Rules (Transaction codes and Tcode objects) that we can use in the Rule Architect.
My question is how do i enable and use those pre-set SOD Rules that Virsa provides by default. I do not see them under the Rule architect tab though. Can someone give some pointers to use these pre-set SOD rules.
Thanks & Regards
-Murali

Hi Laziz,
Thanks for your patience in replying to my CC 5.1 queries. I did follow your steps for the Generate Rule & Background Job-> Schedule Analysis and scheduled the job immediate.
However, when i looked up the status of the scheduled analysis Background Job-> Search pulls up the job i scheduled at the top it reads "Job scheduler Status: unknown error" . I clicked on "View Log" button and it shows some messages as shown below (Note: I am just posting some parts of the error msgs below. but it still goes for 1 page...)
May 16, 2007 1:09:07 PM com.virsa.cc.xsys.bg.BgJobDaemon init
INFO: *** BgJobDaemon loaded
May 16, 2007 1:11:09 PM com.virsa.cc.common.util.ConfigUtil setDefaultJ2EEParam
WARNING: Cannot get Application URL: null. PLEASE SET 'Background Daemon URL' IN CONFIGURATION TAB
java.lang.NullPointerException
     at com.virsa.cc.common.util.ConfigUtil.setDefaultJ2EEParam(ConfigUtil.java:203)
     at com.virsa.cc.common.util.ConfigUtil.getBgJobStartURL(ConfigUtil.java:192)
     at com.virsa.cc.xsys.bg.AnalysisDaemonThread.run(AnalysisDaemonThread.java:45)
     at java.lang.Thread.run(Thread.java:534)
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.ReportPack50SP1_01 class: com/virsa/cc/extreport/ReportPack50SP1_01/ReportPack50SP1_01.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=1568 compressed size=1568 actual read=1568
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.CrtActbyRsk_Act_RskLvl class: com/virsa/cc/extreport/ReportPack50SP1_01/CrtActbyRsk_Act_RskLvl.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=13210 compressed size=13210 actual read=13210
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.CrtRolbyRsk class: com/virsa/cc/extreport/ReportPack50SP1_01/CrtRolbyRsk.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=19287 compressed size=19287 actual read=19287
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.CrtProfbyRsk class: com/virsa/cc/extreport/ReportPack50SP1_01/CrtProfbyRsk.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=12807 compressed size=12807 actual read=12807
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.UsersbyOrgLevels class: com/virsa/cc/extreport/ReportPack50SP1_01/UsersbyOrgLevels.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=18557 compressed size=18557 actual read=18557
May 16, 2007 1:24:59 PM com.virsa.cc.common.util.ConfigUtil setDefaultJ2EEParam
WARNING: Cannot get Application URL: null. PLEASE SET 'Background Daemon URL' IN CONFIGURATION TAB
java.lang.NullPointerException
I am not sure whats causing this and it's been 2hrs since i scheduled the user analysis but i don't see any data still appearing in the fron-end..Any pointers again???
Thanks
-Murali

Error while performing Risk Analysis at user level for a cross system user

Dear All,
I am getting the below error, while performing the risk analysis at user level for a cross system (Oracle) user.
The error is as follows:
"ResourceException in method ConnectionFactoryImpl.getConnection(): com.sap.engine.services.connector.exceptions.BaseResourceException: Cannot get connection for 120 seconds. Possible reasons: 1) Connections are cached within SystemThread(can be any server service or any code invoked within SystemThread in the SAP J2EE Engine), 2) The pool size of adapter "SAPJ2EDB" is not enough according to the current load of the system or 3) The specified time to wait for connection is not enough according to the pool size and current load of the system. In case 1) the solution is to check for cached connections using the Connector Service list-conns command, in case 2) to increase the size of the pool and in case 3) to increase the time to wait for connection property. In case of application thread, there is an automatic mechanism which detects unclosed connections and unfinished transactions.RC:1
Can anyone please help.
Regards,
Gurugobinda

Hi..
Check the note # SAP Note 1121978
SAP Note 1121978 - Recommended settings to improve peformance risk analysis.
Check for the following...
CONFIGTOOL>SERVER>MANAGERS>THREADMANAGER
ChangeThreadCountStep =50
InitialThreadCount= 100
MaxThreadCount =200
MinThreadCount =50
Regards
Gangadhar

Cross-systems analysis and max. rules for a risk

Hi all,
Customer environnement: GRC AC RAR 5.2 linked to 3 R3 4.6C environments (FB0, FB1 and FB2) with different purposes. Users and roles can exist in the 3 systems so we need to run cross systems analysis.
It turns out that the cross-systems analysis works well only if you declares the functions on only 2 environments (FB0 and FB2 or FB0 and FB1).
If we declare the functions on 3 environments (FB0, FB1 and FB2) one reaches the maximum number of rules for a risk, namely 46 655.
This limit is it revised upwards in version 5.3 (if yes, how?)
Or there happens a workaround solution to run cross system analysis on multiple physical systems (the customer environment target is 6!) ?
Regards

The limit is based on the number of character combinations are available for a risk, so if the number of characters has been increased thenteh number of rules available won't have been increased.
In AC 5.3 the number of characters for a risk ID is 4 which is the sames as AC 5.2 therefore I doubt trhat the limit has been lifted of the code changed to accomodate mor rules per risk.
The only way around the issue is to create smaller risks instead of looking in systems 1, 2 & 3 look in 1 & 2, and 2 & 3 and 1 & 3. Not ideal but at least you will get some results.
Sounds likje an enhancement request needs to be raised to me.

Compliance Calibrator SOD Conflict (FI01 and FB05)

I was hoping that someone could provide some insight as to why the "FI01 - Create Bank" and "FI02 - Change Bank" transactions would create a risk (in Compliance Calibrator) when coupled in the same security role with the "FB05 - Post with Clearing" transaction. The risk description given by Compliance Calibrator is "Maintain bank account and post a payment from it".
The FI01 and FI02 t-codes appear to only create/change routing numbers or addresses for banks. There is no ability to create or change an actual bank account. This alone doesn't seem to create a conflict when coupled with a posting transaction. Is there possibly some functionality that I am missing?

Hi Joshua,
I strongly agree with you that there is no SOD conflict technically with FI01, FI02 with FB05 although the wording of the SOD conflict in a business sense meaning Maintain Bank Accounts vs Posting Payments sounds more like a Conflict.
I dont see by anyway how you can maintain actual bank account in either FI01, FI02.
FI01 and FI02 - Maintain Bank Info like Bank Address, Bank Key and soforth.
FB05 - Make Payments to various accounts.
Regards,
Kiran Kandepalli.

Batch risk analysis over cross system

Hi,
I have the folllowing problems with batch risk analysis over cross system group (SP14) when I run the batch risk job over this group of connector:
- The number of users analyzed are wrong in reports.
- The last update date are wrong in reports.
- The reports shows some risks with locked and expired users. For example I have 3 connector in a group and user A is not locked in connector 1 but locked in 2 and 3. The reports shows this A user in all the connectors included in the cross system.
Does anyone have a similar scenario? How resolve it? Any tip is welcome.
Kind regards,

Hi,
SAP solved my problems with the following notes:
-1988650 - GRC 10.0: user analyzed for single & cross connector and SAP_ALL profile disappear for cross system in ad-hoc risk analysis.
- 2028860 - AC10.0 GRACMGRISKD table shows riskid for riskcount zero
Regards,

SAPu00AE COMPLIANCE CALIBRATOR BY VIRSA SYSTEMS

Hello all,
My company are thinking of implementing the above for auditing purposes to comply with Sarbanes-Oxley and compliance. I have read some documentation from the SAP website and this documentation states that:
"Because SAP Compliance Calibrator by Virsa Systems is embedded in your SAP system, no additional hardware or software is required."
Has anyone implemented this soultion? If so is there any additional documentation available for it?
Cheers,
Bernard.

David,
As We are in the process of implementing this virsa tool but we are not sure as to what are the exact steps that we should extract to. Do you have a step by step guide (apart from the VIRSA install guide) which would guide us through the complete install and configuration. We have ECC 6.0 ,Portal,BI 7,CRM 5
Would you be kind enough to send the information to me asap.
Please forward me the doc to following id , I will be very much appreciate if you could do the help ..
[email protected]
Thanks
Laxmi

Need some practical Scenarios to test Compliance Calibrator, FF and AE

Hi Experts,
I have installed Compliance Calibrator 5.2 / Access Enforcer and Firefighter on a test System. However i am looking for some practical scenarios / Examples to test the functionlity of these installations. If any of you is currently working on these technologies i appreciate if you c an provide 2 3 scenarios to test my installation and functionality .
Thanks in advance.
Your help is much apprecaited..
SK

Hi SK,
Testing the functionality of CC
1. I would recommend to create some test roles where in you plug in some conflicting tcodes
    which can pose a sure SoD Risk, lets say Create Vendor Invoice(FB01) and Make an
    Automatic Payment(F110).
2. Now run the Risk Analysis by choosing the Default SAP GRC ruleset library and do a
    Role level Analysis.Then Assign the Test Roles to Test Users and then do a User Level Analysis.
3. You may have create some Custom Rule sets with appropriate naming of Conflicting functions
    like Creation of Purchase Order (P001), Approve Purchase Order(P002)
    in different Application Areas like Purchase 2 Pay(P2P), Order 2 Cash (O2D) and try to do
    the same as above two steps.
4. Test the functionality of Risk Remediation by removing the conflicting tcodes and do the
    Risk Analysis.Your previous Risk Roles must not appear
5. Test the functionality of Risk Mitigation by placing a mitigation Control on the Conflicting tcodes
   and do the Risk Analysis.Your previous Risk Roles must not appear if you have properly
    configured your CC
Testing the functionality of FF
1. I would say create a few Firefighter IDs in different functional areas like FI, SD, MM, and then
   create some test users for Firefighter Owners, Controllers and Firefighters who can use
   the functionality of FF.
2. Create some FF roles which have exceptional access in those functional areas
    encompassing transaction codes and authorization objects that are not used in normal incidents.
3. Assign each of the FF roles to the respective FF IDs and then to the test Firefighters.
4. Pull the log reports in FF and see if it gives exact details of the FF usage.
5. You may have take some assistance of the Functional team members to do the testing.
Testing the functionality of AE
1. Create a workflow scenario of hiring a new user.
2. Create the request under a test requestor. Assign the request to some test approver
3. Also Assign some roles and test the functionality.
Hope this helps for a good start
Regards,
Kiran Kandepalli.

Compliance Calibrator 5.2 RTA for Non-SAP Apps

Hi all,
Can SoD rules be written for analyzing a Users access to SAP and NON-SAP applications across the enterprise?
If yes will CC RTA need to be installed on the NON-SAP application?
If yes are there any requirements that need to be met by NON-SAP application and is there a list of NON-SAP applications (other than-Peoplesoft, Oracle, Hyperion, JD Edwards) that CC has an RTA for?
Is there any documentation specific to aplications that can support CC RTAs and installation on these?
-Cheers

Hi,
Yes SoD rules can be written for analyzing user accesses to SAP and non-SAP applications.
Basically there is no other application for which an RTA exists, but there is a documentation discussing the technical requirements for file generation from the non-SAP systems for integration of non-SAP Systems with SAP Compliance Calibrator.
This documentation is available in <a href="http://service.sap.com/rkt-grc">http://service.sap.com/rkt-grc</a>
under SAP GRC Access Control 5.2 -> SAP GRC Compliance Calibrator 5.2 -> Step2: Prepare for your project -> Cross Application Material
You'll need your OSS user-id to access that page; in case you cannot access it, please post a message in the OSS.
Rgds,
Karim

Compliance Calibrator Start up

Hi,
We are planning to bring SOD tool Compliance calibrator soon for our r/3 system.......
before that I need to know how it works....I mean SAP provides CC software to be installed on R/3 server???
Can some tell me on which server CC installation takes place.

Hi Lisa,
Purpose of Installing RTA in R/3 Server
==============================
This is an ABAP component which continously and regularly collects data from R/3 Server. As I said, this the Backend used by all the GRC components that is:
1)Access Enforcer
2)FireFighter
3)Role Expert and
4)Compliance Calibrator
What we install in J2EE Server and Purpose of it
====================================
These are Java Deployable files (called Software Deployable Archives, SDA). These files form the frontend to access GRC components. The purpose of this is that, this forms an Interface to access the different applications.
You have different SDAs for different applications like:
1)Access Enforce
2) Role Expert
3) FireFighter and
4) Compliance Calibrator
For each application, you have respective Java Deployable files i.e., SDAs. Example, if you want to use Compliance Calibrator, then you need to install it FronEnd files (SDAs) on J2EE server access through Web Browser.
Data Flow
=========
I will take Compliance Calibrator example and explain it you you:
You have RTA installed in R/3 server and frontend files on J2EE server.
As you know, Compliance Calibrator is SODs violations reporting tool. Here you define all the rules and save it. You run reports called "Synchronization" for:
Users
Roles and
Profiles
When you run this, RTA (ABAP component in R/3 Server) will send the data as per your selection (User/Role/Profile) to FrontEnd on J2EE server where it maintains its own database in J2EE server for rendering purpose.
Then you run the "Risk Analysis" reports in front end of different types:
User
Roles and
Profiles
Then it gives you the reports accordingly. Any change in the R/3 Server, you need to re-run the "Synchronizaiton" reports again. Usually, these reports are run every day on "Incremental" basis.
Hope, this will answer what you have asked for.
Feel free to ask further queries.
Reward points if useful.
Thanks and Regards,
Faisal

Compliance Calibrator v4.0 - Cross System SoD Analysis

Similar Messages

Maybe you are looking for