RA&R rules 5.3 changes compared to standard global rule set

Good day,
Please can someone assist me. I need to compare a clients customised rule set to the standard rule set, and document where changes have been made. (There is no log of the changes) A client has made modifications to the rule set, we are not sure if these modifications were valid, so we need to compare these to the standard rule set. The problem is that the client has modified the "GLOBAL" rule set, so I do not have a base rule set to work from. I have looked at the initial upload files, but they are not easily compared with the current production rule set. Does anyone have any solutions as to how this could be achieved?
Thank you and Kind Regards
Jill

Hi ,
How the client has modified the GLOBAL Rule Set in RAR, are they just dectivated the risk from the global rule set? or deleted the risks peminately.
if they dectivated the Risks in GLOBAL Rule set, just download the Rules through utilities(Cofiguration) and check the values which are having the '0' (ZERO) values, those risks only deactivated. it is the better process to sagarigate rule set.
Regards,
Arjuna.

Similar Messages

Change History When Importing DEV Rule Set to PRD

Does anyone know what effect importing the DEV rule set in PRD has on the change history in CC5.x? In other words, if one imports the DEV rule set into PRD, will the change history capture any changes that were made to the risks and functions during the import process?
Thanks!

Importing the Rules to a new environment is like creating them anew from scratch. Any new function/risk creation does not appear in the Change history at all. 'Change' only refers to modification done to the original entries.
Cheers!!

Mass RAR Rule Set Changes

My integrator is telling me that there is no way to complete a mass update to the authorizations/restrictions in our RAR rule set (AC 5.3.) That is, at the recommendation of our external auditor, we added additional transactions to existing rules but failed to activate the company code restrictions to ignore display only access and therefore, I am receiving a significant number of SODs which are false positives.
I find it hard to believe that there is no easy way to activate the company code authorization objects (and others) for the additional transactions in the rule set. The integrator is telling me that this has to be done one by one. Please tell me that there is an easier way.
Apologies if this is a repeat; if this topic is out there, could someone point me in the right direction?Thank you in advance!
Thank you in advance!

Is there any easy way? Depends on what you think is easy
For mass updates to function I will typically use the: Configuration -> Rule Upload feature. To perform an update to an authorization object, you would use the 'Function Authorization' selection.
To upload the function you'd want to use the file formats from the 9 upload files SAP provides for the ruleset. If I recall correctly, function uploads will overwrite the existing function so it is important that your upload file contains all existing function data + the additional auth objects you want to activiate.
As with any text file manipulation and download/upload or export/import features into GRC you want to be particulary careful with formatting and attention to detail. Probably a good idea to take a backup of the rules if this is your first time working with the ruleset files.

FBL5N - in Rule set - It is a Display customer line items

Dear All,
We observed that FBL5N - Display customer line items in Standard SoD rule set under function AR07 addressing a risk of S022.
Unless there are t-codes of FD03 or FB02 this t-code does not allow to change the payment terms of the customer.
We are having a challenge from the client that FBL5N is a display t-code and why it is there in rule set.
Has anybody came across this scenario? If yes, what is the underlying risk for this FBL5N independently.
Is there any SAP Note for this t-code like ME23N from SAP.
Thanks and Best Regards,
Srihari.K

Hi Christian,
We checked the authorization objects as well enabled in GRC rule set as below:
F_BKPF_BUK - Docume t Authorization document for company codes - 01 or 02 - Enable.
Inspite of this access, FBL5N cannot be used to change the document for payment terms and assignments without FB02 t-code
assignment in the role.
Independently FBL5N cannot be used for any change or create activity except Display customer line items.
Please advise
Thanks and Best Regards,
Srihari.K

I have messages in mail that are color-coded as if by a rule, but I have no rules set. How can I correct this?

The only rule that I ever had in Mail was the default one that color coded messages from Apple blue. I notice that some messages are color-coded brown and I have no rules set at al (hence no rule to turn off.) Some of the messages are related to viewing online magazine, but not all. How can I stop this?

Hi. Thanks for your message.
Well, I understand what you are trying to say but I thought it was easier to categorize in Apple Mail.
On Entourage I just click twice on a sender address, record it on Address book and give it a colour that I previously defined as "Work", "Personal", "Customers", "Suppliers", "Friends" or whatever.
As Apple Mail don't have Address Book as part of it but an outside feature it's very annoying. Of course I am used to use a software and I don't expect now Apple Mail do everything as Entourage but... as someone said it seems Apple Mail stopped in time. The recent version seems the first one ever issued. I hate the way Mail.app handles attachments by placing big chunky previews right in my email. I prefer them to be named attachments listed somewhere else, out of the content of my email. I don't if I can change this via terminal commands? Can you tell me if that is possible?
I don't understand why Apple Mail have lots of plugins instead of a great improvment from the backstage.
I use Apple computers since ever and I love this machines but sometimes I don't understand this lake of improvments.
Take a look at this link:
http://scottworldblog.wordpress.com/2009/10/12/microsoft-entourage-vs-apple-mail /
Of course I don't agree 100% with him but some things are true...

Do you trust the SAP standard rule set ?

Hello all,
I have the impression that, too often, the SAP standard ruleset has been taken for granted : upload, generate and use. Here is a post as to why not to do so. Hopefuly, this will generate a interesting discussion.
As I have previously stated in other threads, you should be very careful accepting the SAP standard rule set without reviewing it first. Before accepting it, you should ensure that your specific SAP environment has been reflected in the functions. The 2 following questions deal with this topic :
1. what is your SAP release ? ---> 46C is different than ECC 6.0 in terms of permissions to be included in the function permission tab. With every SAP release, new authorization objects are linked to SAP standard tcodes. Subsequently some AUTHORITY-CHECK statements have been adapted in the ABAP behind the transaction code. So, other authorizations need to provided from an implementation point of view (PFCG). And thus, from an audit perspective (GRC-CC), other settings are due when filtering users' access rights in search for who can do what in SAP.
2. what are your customizing settings and master data settings ? --> depending on these answers you will have to (de)activate certain permissions in your functions. Eg. are authorization groups for posting periods, business areas, material types, ... being used ? If this is not required in the SAP system and if activated in SAP GRC function, then you filter down your results too hard, thereby leaving certain users out of the audit report while in reality they can actually execute the corresponding SAP functionality --> risk for false negatives !
Do not forget that the SAP standard ruleset is only an import of SU24 settings of - probably - a Walldorf system. That's the reason SAP states that the delivered rule set is a starting point.
So, the best practice is :
a. collect SAP specific settings per connector in a separate 'questionnaire' document, preferably structured in a database
b. reflect these answers per function per connector per action per permission by correctly (de)activating the corresponding permissions for all affected functions
You can imagine that this is a time-consuming process due to the amount of work and the slow interaction with the Java web-based GRC GUI. Therefore, it is a quite cumbersome and at times error-prone activity ...... That is, in case you would decide to implement your questionnaire answers manually. There are of course software providers on the market that can develop and maintain your functions in an off-line application and generate your rule set so that you can upload it directly in SAP GRC. In this example such software providers are particularly interesting, because your questionnaire answers are structurally stored and reflected in the functions. Any change now or in the future can be mass-reflected in all (hundreds / thousands of) corresponding permissions in the functions. Time-saving and consistent !
Is this questionnaire really necessary ? Can't I just activate all permissions in every function ? Certainly not, because that would - and here is the main problem - filter too much users out of your audit results because the filter is too stringent. This practice would lead too false negatives, something that auditors do not like.
Can't I just update all my functions based on my particular SU24 settings ? (by the way, if you don't know what SU24 settings are, than ask your role administrator. He/she should know. ) Yes, if you think they are on target, yes you can by deleting all VIRSA_CC_FUNCPRM entries from the Rules.txt export of the SAP standard rule set, re-upload, go for every function into change mode so that the new permissions are imported based on your SU24 settings. Also, very cumbersome and with the absolute condition that you SU24 are maintained excellent.
Why is that so important ? Imagine F_BKPF_GSB the auth object to check on auth groups on business areas within accounting documents. Most role administrator will leave this object on Check/Maintain in the SU24 settings. This means that the object will be imported in the role when - for example - FB01 has been added in the menu. But the role administrator inactivates the object in the role. Still no problem, because user doesn't need it, since auth groups on business areas are not being used. However, having this SU24 will result in an activated F_BKPF_GSB permission in your GRC function. So, SAP GRC will filter down on those users who have F_BKPF_GSB, which will lead to false negatives.
Haven't you noticed that SAP has deactivated quite a lot of permissions, including F_BKPF_GSB ? Now, you see why. But they go too far at times and even incorrect. Example : go ahead and look deeper into function AP02. There, you will see for FB01 that two permissions have been activated. F_BKPF_BEK and F_BKPF_KOA. The very basic authorizations needed to be able to post FI document are F_BKPF_BUK and F_BKPF_KOA. That's F_BKPF_BUK .... not F_BKPF_BEK. They have made a mistake here. F_BKPF_BEK is an optional auth object (as with F_BKPF_GSB) to check on vendor account auth groups.
Again, the message is : be very critical when looking at the SAP standard rule set. So, test thoroughly. And if your not sure, leave the job to a specialized firm.
Success !
Sam

Sam and everyone,
Sam brings up some good points on the delivered ruleset. Please keep in mind; however, that SAP has always stated that the delivered ruleset is a starting point. This is brought up in sap note 986996     Best Practice for SAP CC Rules and Risks. I completely agree with him that no company should just use the supplied rules without doing a full evaluation of their risk and control environment.
I'll try to address each area that Sam brings up:
1. Regarding the issue with differences of auth objects between versions, the SAP delivered rulset is not meant to be version specific. We therefore provide rules with the lowest common denominator when it comes to auth object settings.
The rules were created on a 4.6c system, with the exception of transactions that only exist in higher versions.
The underlying assumption is that we want to ensure the rules do not have any false negatives. This means that we purposely activate the fewest auth objects required in order to execute the transaction.
If new or different auth object settings come into play in the higher releases and you feel this results in false positives (conflicts that show that don't really exist), then you can adjust the rules to add these auth objects to the rules.
Again, our assumption is that the delivered ruleset should err on the side of showing too many conflicts which can be further filtered by the customer, versus excluding users that should be reported.
2. For the customizing settings, as per above, we strive to deliver rules that are base level rules that are applicable for everyone. This is why we deliver only the core auth objects in our rules and not all. A example is ME21N.
If you look at SU24 in an ECC6 system, ME21N has 4 auth objects set as check/maintain. However, in the rules we only enable one of the object, M_BEST_BSA. This is to prevent false negatives.
3. Sam is absolutely right that the delivered auth object settings for FB01 have a mistake. The correct auth object should be F_BKPF_BUK and not F_BKPF_BEK. This was a manual error on my part. I've added this to a listing to correct in future versions of the rules.
4. Since late 2006, 4 updates have been made to the rules to correct known issues as well as expand the ruleset as needed. See the sap notes below as well as posting Compliance Calibrator - Q2 2008 Rule Update from July 22.
1083611 Compliance Calibrator Rule Update Q3 2007
1061380 Compliance Calibrator Rule Update Q2 2006
1035070 Compliance Calibrator Rule Update Q1 2007
1173980 Risk Analysis and Remediation Rule Update Q2 2008
5. SAP is constantly working to improve our rulesets as we know there are areas where the rules can be improved. See my earlier post called Request for participants for an Access Control Rule mini-council from January 28, 2008. A rule mini-council is in place and I welcome anyone who is interested in joining to contact me at the information provided in that post.
6. Finally, the document on the BPX location below has a good overview of how companies should review the rules and customize them to their control and risk environment:
https://www.sdn.sap.com/irj/sdn/bpx-grc
Under Key Topics - Access Control; choose document below:
    o GRC Access Control - Access Risk Management Guide   (PDF 268 KB)
The access risk management guide helps you set up and implement risk
identification and remediation with GRC Access Control.

Transfer changes from Document to the Document Set [Sharepoint bug?]

I I have Document Set, 1 Document inside and, for example,
1 general field.
Task: when I change Document I need to copy value of the general field to the Document Set.
Problem: I made Workflow on Document that calls when I change it, this Workflow copies data to the Document Set.
But it doesn't work, because when I change Document inside Document Set there are 2 events: "Document was changed" and "Document Set was changed". And the event "Document Set was changed" called first and it copies all general
fields to all documents inside. That's why when my Workflow starts, field in Document has value from Document Set not the one that user typed.
Any solutions to solve the task or problem (e.g. to increase the priority for Workflow on documents inside)?

Hi ,
According to your description, my understanding is that you want to copy the value of a field for a document inside a document set to the associated column for document set.
How did you design your workflow?
I did a test based on your description, and I used the ID (in my testing, the ID of the document set is 2)to find the associated document set, and the testAA is the column.
My workflow is:
In my testing, everything was ok. Please have a try as the above workflow, compare the result.
Best Regards,
Wendy
Wendy Li
TechNet Community Support

Is it possible to add a firewall Filter or Rule Set to the Extreme Router (802.11n)

Is it possible to add a firewall Filter or Rule Set to the setting for the Extreme Router (802.11n) like the following:
"ALLOW TCP/UDP IN/OUT to 208.67.222.222 or 208.67.220.220 on Port 53" and
"BLOCK TCP/UDP IN/OUT all IP addresses on Port 53"
The goal of this is to create a firewall rule to only allow DNS (TCP/UDP) to OpenDNS' servers and restrict all other DNS traffic to any other IPs.
Or, alternatively is there a way to configure same applied to the Network preferences on IMAC OS X?
Thanks and much appreciation to anyone who has any clue about this.

Sorry, I think you've got it backwards.
The concern is NOT that the child can make changes to our hardware/AEBS, or even our network software on my IMAC - nothing's been changed.
BUT, he changed the dns settings on his OWN device (ie chromebook) to google public server, accessed the AE using our home wifi network BUT bypassed our dns settings. Capeesh?
See: http://www.pocketables.com/2013/03/how-to-use-change-the-dns-settings-on-your-ch romebook-and-use-googles.html

Mulltiple Rule Sets in GRC 10.0 for one System

Hi All,
We do have 2 different companies working on one system and by that 2 different rule sets that are applicable.
Due to that we are facing different problems we don't know how to solve yet but lets start with the first one dealing with the rule set that should be used in the access request.
We want to determin which rule set should be used over the requested role (e.g. if role name contains 0001 use rule set 0001, if role name contains 0002 use rule set 0002).
We have alerady tried several different senarios in BRF+ without success.
Does anybody have a solution or at least an idea for this topic?
Thank you all very much in advance!
Eva

Hi Ashish ,
Thanks for your time . Let me explain you my requirement and would really appreciate if you would have some inputs here which would help me to design this .
The actual client requirement is to design a CUP Workflow and If there are SOD issues identified, the workflow will need to go to a central team for them to address each issue. If this group decides to apply mitigating controls to the issues, the workflow must then go to the compliance group for them to review for appropriateness. Requirement is do a SoD analysis for every role change/add request , so that this group takes the appropriate action based on the SoD Analysis . For all my CUP request raised , i want system to do a SoD analysis and let this group know whenever there is a SoD found or just end the workflow if there is no risk.
I am aware of the Risk analysis process for GRC 10.0 , however i want it to happen as a part of this work flow requirement.
The requirement is to configure the access request work flow so that the end goal of work flow is just facilitation of an SOD review. I hope i was able to explain my requirement . Thanks again for your help.
Your valuable guidance would be really appreciated.
Vikas

Rule set migration from GRC 5.3 to GRC 10.0

Hello everyone,
I ask you this question: if I want to migrate from GRC 5.3 to GRC 10.0, can I keep my old custom rule set with no modification or I have to make some changes to it to import in GRC 10?
Thankyou in advance for the answers
Greetings
Gianluca
Edited by: Gianluca Mocini on Apr 1, 2011 5:33 PM

Hi,
The migration utility is very simple. You install it on GRC 5.3 box and then select the items you want to migrate. It will generate tab limited text files and you can use those files to import data into 10.0 box.
Regards,
Alpesh

Downloading a single rule set out of N rule sets.

HI All,
We have defined 4 Rule sets for one particular system. Out of these one is the global rule set. Now, my requirement is to have oe more rule set, with 80% rules from global and then add the rest 20% myself. Would like to know if there is any way we can achieve this efficiently, other than creating manually all the 80% rules from GLOBAL rule set.
Thanks a lot in advance.
Regards,
Hersh

HI Jose,
Well what you guided was perfectly fine an true in case of making changes to GLOBAL rule set. But any idea how we can make a new rule set out of the custom rule set i have already made.
I have , in all 4 rule sets present at the moment in GRC - GLOBAL, CUST -1,2 and 3. Now, my requirement is to have a copy of CUST1 into new rule set CUST4, and I manually later on need to update CUST4 for some more risks in it. The problem i am facing is whenever i download the existing rule sets, it is not giving me an option to download just CUST1, but all of four rule sets get downloaded together. Whereas, i need just a copy of CUST1. Any ideas on this?
Regards,
Hersh.

Access to update the GRC rule set is limited

Hello - What is the process (tcode) to see who has access to update the GRC rule set?
Thanks!

Hi Sam,
What is the version of your RAR (CC)? If it is CC 4.0 then you enter the product via tcode and go to rule architect to make changes. If you have CC 5.X then you go through the web browser and go to Rule architect to make changes to the rule set.
The process to change a rule set is as below:
1) Creats Function
2) Create risk
3) Create Rule
Regards,
Alpesh

Need information on the new RAR Rule Architect/Rule Set functions

Does anyone have any information on the new 5.3 functions listed under Rule Architect/Rule Sets, specifically the Compare function?
My 5.3 Config manual mentions this area but doesn't describe anything about it. I have a request from our user group and need to determine if this can fit that request.
What they are looking for is an easy way to compare our RAR Rule Set with the latest SAP version (Q2 2010 is the most recent I believe). Just from the screen shots, it looks like we could maybe use the Rule Sets functions for that. Load the new SAP one into RAR as a separate ruleset and then run this Compare function. However I haven't been able to find any documentation on this function, so I don't know if it really does what we are looking for.
Thanks.

Hi,
the error 'NullPointerException ' is very common error in GRC.
kindly search, you will find lots of threads and notes on thi.
check you permission TXT file. It contain null value some where.
especially check SD01 & SD02 tcodes.
Also open permission file in word and check all TAB's and ENTER's in technical view.
Regards,
Surpreet

Multiple GRC rule set update

we are having a custom rule set A loaded in GRC. Now we want another rule set B, with new risks and definition to be loaded in GRC. If we try to upload rule set B risks and functions via Upload function in GRC, would it overwrite the rule set A, or not.Just wanted to confirm whether existing rule set A would be affected or not, due to upload of rule set B.

Hey Alpesh,
Sorry, I haven't understand it correct. This is a question that will always be asked in the train.
You wrote:
"If you have created different files (e.g. risks, ruleset, function action, function permission etc.) and upload them via configuration -> rule upload then RAR will not overwrite your ruleset A and will only insert new rule set files."
Is this just possible, if all IDs (risk, function, function action, function permission) will be changed before and could not be equal like in the rule set A? correct?
What's about with the ALL.txt files, do I have to change/upload them as well again?
Thanks for feedback,
alwaly a pleasure!
Greets
Martin

GRC53 Rule Set Migrated into GRC10

Gurus, has anyone encountered the following situation. We migrated our 53 rule set into GRC 10 using the Migration Tool. On the surface all of the rule objects seem to move across as they should. We then began to run our risk reports. We noticed that for the same user, in the same backend ECC system, we get varying results from our 53 Rule Set which is in our GRC10 system vs the 5.3 Rule Set executed from our old 5.3 system. We see more violations returned from our old 5.3 system; entire risks are not reported from the GRC10 system.
Consequently, I began reviewing the functions (actions/permissions). I picked a specific risk that was returned by the 5.3 system and reviewed it, line by line - comparing the 53 Rule Set in GRC10 against the 53 Rule Set in the 5.3 system. Everything lined up, with the exception of the activity values. In the 53 Rule Set that was migrated into GRC10 the activity values are single digits (1,2,5, etc) where as in the 5.3 System the activates are two digits (01, 02, 05, etc), Since the values are mainatined in SAP as double digits, could this be causing this? I would hope this is not the culprit, but I am unsure where else to turn.
I will say for those risks that were returned in the results, the activities in those functions were single digits as well.

Hi Penn,
Can you check if your default SoD risk level is "Critical" and hence all the conflicts are not being thrown in 10.0
There is an SAP Note 1632864 where you need to maintain parameter 1024 and se tthe default risk level to High. Since there is no option of All in 10.0 similar to 5.3
Thanks and Best Regards,
Srihari.K

RA&R rules 5.3 changes compared to standard global rule set

Similar Messages

Maybe you are looking for