GRC Systems Compatibility
This is a guide to provide compatibility between GRC components in all GRC systems. As there are many questions raised regarding compatibility of GRC with plug-ins, SAP_BASIS versions and enhancement packages, I decided to put this information all together in one single guide. Starting from Virsa to GRC 10.1.
Search for compatibility information in service.sap.com/pam
Table of contents
Virsa 4.0
This version of virsa is out of maintainance since 15.03.2014.
Access the Migration Guide if you want further instructions on how to move from 4.0 to 10.0.
If you want to know what will be migrated:
Access Control 4.0 Migration to v10.0 – Governance, Risk and Compliance – SCN Wiki
Compatibility of Virsa 4.0 with Netweaver Releases:
- 2072255 – Is VIRSA 4.0 Supported on EHP 7?
Virsa 5.3
Compatibility of Java Packages and VIRSA components:
AC 5.3 Java SP15-SP21 can be used with VIRSANH SP16 to 22 (SP10-16 for 710/730) for those customers that are not able to upgrade both Java and ABAP stacks simultaneously.
Compatibility of Virsa 5.3 with Netweaver Releases:
- Is Virsa 5.3 compatible with Netweaver 7.4 (SAP_BASIS 740)?
- Implement the following SAP note to make 5.3 compatible with NW 740:
- 1918850 – GRC AC5.3 plug-in Compatabile for SAP_BASIS 740 release
- Implement the following SAP note to make 5.3 compatible with NW 740:
- VIRSAHR and VIRSANH is compatible with NW 730 from SP17 onwards.
- VIRSANH and VIRSAHR is compatible with NW 711 after implementation of 1675165 note.
Be aware that Virsa 5.3 will be out of maintenance from 31.12.2015.
From 5.3 to 10.0
If you are migrating from Virsa 5.3 to GRC 10.0 you need to know that:
- GRC 10.0 does not work with front-end Java anymore. The new GRC model is all based in ABAP and ABAP webdynpro
- A new model concept was adopted (Foundation system and plug-ins systems). The foundation centralizes the master data.
To those who use Virsa 5.3 and are migrating to a new GRC version (10.0 or 10.1), the following guides and KBAs can be used during the migration:
- Guide to migrate from 5.3 to 10.0
- You can also find in this guide, information on how to export data from 5.3 Risk Analysis and Remediation and Superuser Priviledge Management to GRC 10.0.
If you still need to use Java front-end and have installed GRCPINW in the back-end system, you will see that:
- GRCPINW overwrittes VIRSANH
- GRCPIERP overwrittes VIRSAHR
After support package 04 of GRCPINW, the 5.3 function modules are included (support package 04 of GRCPINW and GRCPÍERP is equivalent to VIRSANH Support package 16 and VIRSAHR Support package 14 respectively. As the front-end is still based on Java, the minimum SP level required for the front-end system is 15.
From 5.3 to 10.1
All GRC 10.1 Support packages have 5.3 code included.
This is stated in the following KBA:
- 1590030 – GRC 10.0, 10.1 Plug-in & AC 5.3 VIRSA (RTA) Co-Existence
Access Control 10.1 plugins are also supported with an Access Control 5.3 Java front end. You must be at minimum AC 5.3 SP22 for the front end and 10.1 SP07 for the plugin in order for this scenario to be supported.
Access Control 10.0
Below, you can find the most current support packages for GRC 10.0 (from SP 11 to SP 19) and their compatibility with components on the very left column.
PS: The support packages highlighted in green are relevant to GRCFND_A V1000.
| 10.0 Support Packs | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| GRCFND_A V1000 | ||||||||||
| SP 14 | SP 15 | SP 16 | SP 17 | SP 18 | SP 19 | SP 20 | SP 21 | SP 22 | SP 23 | |
| GRCPOR | No SP | SP 11 | No SP | No SP | No SP | No SP | No SP | No SP | No SP | No SP |
| GRCACM | No SP | No SP | No SP | No SP | No SP | No SP | No SP | No SP | No SP | No SP |
| 700 | ||||||||||
| GRCPINW | SP 14 | SP 15 | SP 16 | SP 17 | SP 18 | SP 19 | SP 20 | SP 21 | SP 22 | SP 23 |
| GRCPIERP | SP 15 | No SP | SP 15 | SP 16 | SP 17 | SP 18 | SP 19 | SP 20 | SP 21 | SP 21 |
| 710 or 730 | ||||||||||
| GRCPINW | SP 14 | SP 15 | SP 16 | SP 17 | SP 18 | SP 19 | SP 20 | SP 21 | SP 21 | SP 22 |
| GRCPIERP | Not Av. | Not Av. | Not Av. | Not Av. | Not Av. | Not Av. | Not Av. | Not Av. | Not Av. | Not Av. |
| 731 or 740 | ||||||||||
| GRCPINW | SP 05 | SP 06 | SP 07 | SP 08 | SP 09 | SP 10 | SP 11 | SP 12 | SP 13 | SP 14 |
| GRCPIERP | SP 14 | No SP | SP 15 | SP 16 | SP 17 | SP 18 | SP 19 | SP 20 | Not Av. | SP 21 |
* Prior to GRCFND_A SP10, the GRC system and all plug-in systems must be on the same support pack level. As of GRCFND_A SP10, backward compatibility has been introduced. Please refer to SAP Note https://css.wdf.sap.corp/sap/support/notes/1821368 for more details.
Compatibility of GRCFND_A V1000 with Netweaver Releases:
- GRC foundation is compatible with Netweaver 702 Support package 06 onwards;
- GRC foundation is also compatible with Netweaver 731 since GRCFND_A is on Support package 08;
- GRCPINW and GRCPIERP is compatible with NW 730 from SP05 onwards.
- GRCPINW and GRCPIERP are compatible with ECC 6.0 EHP7 (see requisites in SAP note 1820906)
Click Here to check what’s new in GRC 10.0.
Access Control 10.1
The below tables shows the Compatibility Matrix in GRC 10.1.
PS: The support packages highlighted in green are relevant to GRCFND_A V1100.
| 10.1 Support Packs | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| GRCFND_A V1100 | |||||||||||
| SP 04 | SP05 | SP06 | SP07 | SP08 | SP09 | SP10 | SP10 | SP11 | SP12 | SP 13 | |
| 700 | |||||||||||
| GRCPINW | SP04 | SP05 | SP06 | SP07 | SP08 | SP09 | SP10 | SP10 | SP11 | SP12 | SP 13 |
| GRCPIERP | SP04 | SP05 | SP06 | SP07 | SP08 | SP09 | SP10 | SP10 | SP11 | SP12 | SP 13 |
| 710/730 | |||||||||||
| GRCPINW | SP04 | SP05 | SP06 | SP07 | SP08 | SP09 | SP10 | SP10 | SP11 | SP12 | SP 13 |
| GRCPIERP | SP04 | SP05 | SP06 | SP07 | SP08 | SP09 | SP10 | SP10 | SP11 | SP12 | SP 13 |
| 731/740 | |||||||||||
| GRCPINW | SP04 | SP05 | SP06 | SP07 | SP08 | SP09 | SP10 | SP11 | SP12 | SP13 | SP 14 |
| GRCPIERP | SP04 | SP05 | SP06 | SP07 | SP08 | SP09 | SP10 | SP10 | SP11 | SP12 | SP 13 |
Important Information:
– Please see SAP Note 1855404. There was an issue with the SP10 package and SP11 needed to be created which caused the 731/740 GRCPINW SPs to be out of sync with GRCFND_A and GRCPIERP
– When importing GRCPINW V1100_731 from SP 10, system will request Support Package 11 to be applied (Using MOPZ or updating directly from SAINT/SPAM). System is picking up the correct support package. It means that SP 11 will be installed in 731 plug-ins systems when foundation is still on Support package 10.
For GRC 10.1 Foundation and GRC 10.1 Plugin systems, it is recommended to have both systems at the same level, however GRCFND_A 10.1 will be compatible with all 10.1 plugins as long as the plugin SP level is equal to or lower than the Foundation. (ex: GRCFND_A cannot be on SP02 while the plugin is on SP04).
Compatibility of GRCFND_A V1100 with Netweaver Releases:
Access Control 10.1 GRCFND_A needs to be installed on NW740 (at least Support package level 02) and it is compatible with GRCPINW (700, 710, 730, 731).
GRCPINW (GRCPINW_V1100_700) will be installed in a system with SAP_BASIS 700 with minimum SP level 13. The other versions will be installed following the same logic. You will
choose your GRC version based on your SAP_BASIS version. Eg: SAP_BASIS 702, GRCPINW V1100_700.
Click Here to know what’s new in GRC 10.1.
Information on Migration from GRC 10.0 to 10.1
You can connect to AC 10.0 Plug-in (GRCPINW & GRCPIERP) from AC 10.1 front-end as long as support pack of AC 10.0 plug-in is SP10 and above.
However, some new AC 10.1 functionalities such as Organization Rule Wizard, Custom User group creation and EAM DB log collection will not work.
What Databases work with GRC 10.1
(This information was brought by Kelly Ann Erickson):
First note that GRC 10.1 is installed only on SAP Netweaver systems beginning with SAP_BASIS version 740.
See installation guide for patch level needed for installation.
As for the database that works with SAP system, see the Product Availability Matrix to see which database versions are supported. GRC works with
whatever databases NW 7.40 supports.
- Go to Support Portal: https://support.sap.com/home.html
- Then navigate to Release, Upgrade & Maintenance Info > Product Availability Matrix. Click on orange box labeled Enter the Product Availability Matrix.
- Then click on Display all Product Versions. At the top is an open search field, enter SAP Access Control 10.1 and click on the results to view.
- Click on General Information > Related Product Versions. You will see a box labeled Required Product Versions. In that box scroll down to SAP NetWeaver 7.4 and click on it.
- In next screen Click on Technical Release Information and you will see Database Platforms on the menu bar. Click on it.
GRC 10.1 and Netweaver 7.5
GRC 10.1 (foundation system) is supported in NW 7.5 according to the following KBA:
2308327 – Is GRC 10.1 also supported for Netweaver 7.5?
References
The tables information was taken from:
- 1352498 – Support Pack Numbering – GRC Access Control
The Netweaver compatibility was taken from:
- 1680268 – Compatibility of Access Control Packages
The documenation was taken from:
- 1243085 – Available Documentation for GRC Access Control
The co-existance of components (5.3 and 10.0 or 10.1) was taken from:
- 1662113 – Using Access Control 5.3 with your 10.0 and 10.1 plug-in systems
The Migration from 10.0 to 10.1 was taken from:
- 1590030 – GRC 10.0, 10.1Plug-in & AC 5.3 Virsa (RTA) Co-Existence
Really great content Fernando! This will answer a lot of customers questions!
Very useful information Fernando, I am glad we have it here ALL-IN-ONE place, thanks for adding it! Keep coming! 🙂
Great work Fernando!
There are a lot of doubts when it comes to version and compatibility between AC and NW, this is indeed a very useful one stop that should solve many questions!
Dear Fernando,
Excellent Information in single page and easy to refer.
Regards
Baithi
Well done Fernando. Keep it up.
Very useful information! Thanks for creating it Fernando.
Excellent. All in one: Virsa to 10.1.
Excellent Information Fernando. Thank you so much.
Good One...Thank you so much.
Hi Fernando,
I'm having a problem interpreting the purpose of the compatibility tables and what they tell me. For example, my customer has GRCFND_A V1000 SP16, with a plugin of GRCPIERP V1000_700 SP13
On your Access Control 10.0 table, if I go to the GRCFND_A SP16 column, then drop down to the 700 / GRCPIERP row, I see SP15. Is SP15 the minimum or maximum or only SP level of GRCPIERP V1000_700 that is compatible with GRCFND_A V1000 SP16 ?
or, given that SAP Note 1821368 says the following...
... since both GRCFND_A and the plug-in are higher than SP10, is everything OK ?
thanks
Hello Martin,
On the access control matrix, I mentioned the "perfect match" between Foundation and plug-in components and their support package levels. Two main things to consider:
1. Ensure that GRCFND_A SP level is always higher or at the same level comparing to GRCPINW or GRCPIERP.
2. Ensure that they are above SP 10 so the plug-ins have backwards compatiblity.
In your case, the two sentences above are true, meaning that your scenario will work perfectly fine.
Have a good day ahead,
Fernando
Oh, if only that were true. But at least you've helped eliminate one line of inquiry 🙂
thanks
Congratulations Fernando! Your post is excellent!
I have a question for a client and maybe you can help me.
We have implemented Access Control 10.1 (SP10) and now we have a requirement to create a connector for a new SAP system. The thing is that this system is on a SAP Basis 4.6C (SP33).
As I could see in SAP Note 1821368 and in your blog, it would be possible to implement plug-in for AC 10.0 but with some limitations. So, do you know which SP level should we implement to align plug-in from AC 10.0 to AC 10.1 SP10? The last available is SP12 released on 26.03.2013.
Thanks in advance!
Fernando
Hello Fernando, Thank you!!! 🙂 As SAP_BASIS 46C is out of maintenance for a long time, they decided to maintain for 10.0 plug-ins. For 10.1, there is no integration between a GRC 10.1 and 46C plug-ins. The plug-in (GRCPINW V1100_46C) does not exist for this version. Best Regards, Fernando Bassuino
Hi Fernando,
I am wonderinf if it would be possible to keep installed in 46C the 10.0 plugin and use it against a 10.1. What do you think?
I know this could cause some issues but this approach does work for ECC 6.0. If this is the case, would be better than just keep a GRC environment in 10.0 only for this incompatibility.
Hi, Fernando,
I installed GRC 10.1 Add-ons and I need to confirm the ERP backend systems Plug-ins
like ERP,CRM,PI,Solman systems.
I find out GRCPIERP_V1100.
Regards
Suresh
Hello Suresh, The GRC plug-ins are dependant of the SAP_BASIS and Foundation version and support package levels. CRM, PI and SOLMAN systems have their own supportability levels. Could you please specify what exactly are you looking for? Do you wish to install GRCPIERP? Best Regards and Happy New Year!! Fernando
Hi Fernando,
Thanks for your reply.
I installed GRCPINW/GRCPIERP plugins in backend systems.
I need more inform about backend systems like CRM,SOLMAN,PI,BW systems add-ons and plug-ins.
Regards
Suresh
Hello Suresh, In this case, the GRC components do not have a dependency with those components. Best Regards, Fernando
Hi Fernando,
Iam planning to activate BC sets for GRC 10.1 Access Control and Risk Management. Can you please help on which are the standard SAP BC sets for AC and RM.
Regards
Suresh
Suresh
you can find this information in the installation guides on the support portal.
thanks.
Kevin Tucholke
Hi Fernando,
Thanks for this blog. Is really helpful for GRC 10.1 info. But I need some more info on Plug-in upgrade in the backend systems, if possible please help.
I have referred the Notes given by you.
We are upgrading from GRC10 to GRC 10.1 ( SPS 12 ). So need to upgrade the plug-ins in the backend systems as well.
But I have SCM system on NW 7.01 and there is GRCPINW V1000_700 SP12. We are upgrading the SPS for this system, so want to upgrade the GRCPINW to V1100_700. I found a exchange upgrade pack for this version and the V1100_700 maintenance SPS12 packs. But during creation of my xml, it does not allow me to chose for this plugin uograde from 10 to 10.1 release.
Can you please let me know if this upgrade is compatible. and is there a clear information on upgrade paths for plugins, 1855404 is not so clear to me.
Thanks in advance.
Hello Madhubrata,
Sorry, Just saw your comments now. Still need help with that scenario?
What is the message system is giving? Are you upgrading from SAINT, SPAM, MOPZ?
Thanks, Fernando
Excellent document Fernando...Very useful...
Hi Fernando,
Firstly this blog has lot of useful information which really helped us with the queries we have regarding SP upgrade.
We are planning to upgrade the GRC access control patch level from SP5 to SP14. We wanted to check if we need to upgrade our java stack as well but could not find any relevant details or SAP notes.
Please share if you have any details. We have raised OSS message as well for this 😯
Thanks in advance
~ Madan
Hi Madan,
Thanks! 🙂
No need to upgrade the java server for a GRC upgrade. The only functionality that is attached to a Java Server is the ADS (Adobe).
Regards,
Fernando
Hello Fernando,
I've found that there is a mistake in your table with SP levels for Plugin system. There is no SP22 for GRCPIERP.
The latest available is SAPK-10321INGRCPIERP GRCPIERP V1000_700: Support Package 0021 (path:
Seems that GRCPINW has overlapped GRCPIERP one more time 🙂
Regards,
Artem
Hello Artem,
Thank you for pointing that out.
Yeah, true! GRCPIERP was overlapped again. 🙂
I fixed the table data.
Thanks again!
Fernando
Where can I find the note that contains the latest Compatibility Matrix Table view for Plug-ins to GRCFND_A V1100?
Also, does ECC EhP8 SPS5 on NW 7.5 require a specific level of GRCPINW patches be applied? I ask because we were not planning to patch our GRC components but the NW Plugin is getting added with EhP8 automatically.
Dear Fernando, As always your posts are coliseum.
Please share insight from perspective of Superuser privilege management - 5.3 and it's co - existenance with GRC 10.1 front-end (GRCFND_A) and back-end plug-in (GRCPINW & GRCPIERP) components and SAP_BASIS. Specifically if GRCFND_A Release V1100 - Service Pack 0008 is planned to be upgraded Service Pack 0017?
Thanks
Hello,
We are planning for GRC 12.0 upgrade.
Any info ??
Thanks
Hello,
We are planning for GRC upgrade from 10.1 to 12.0
I see minimum requirement SAP Netweaver 7.52 SP00
Our system current version is Netweaver 740. GRC 10.1 version.
I would like to know in maitnenance planner can we select both Netweaver 750 upgrade and GRC 12.0 and use single SUM to run the upgrade or do i need to run first Netweaver upgrade from 740 to 750 and then GRC upgrade from 10.1 to 12.0
Regards,
Hema
Hello, Hemavathy.
By any chance, were you able to get confirmation regarding whether Netweaver 7.52 and GRC 12.0 can be done in a single SUM run? Thank you.
Regards,
Julianne