This is a guide to provide compatibility between GRC components in all GRC systems. As there are many questions raised regarding compatibility of GRC with plug-ins, SAP_BASIS versions and enhancement packages, I decided to put this information all together in one single guide. Starting from Virsa to GRC 10.1.
Search for compatibility information in service.sap.com/pam
Table of contents
This version of virsa is out of maintainance since 15.03.2014.
Access the Migration Guide if you want further instructions on how to move from 4.0 to 10.0.
If you want to know what will be migrated:
Compatibility of Virsa 4.0 with Netweaver Releases:
- 2072255 – Is VIRSA 4.0 Supported on EHP 7?
Compatibility of Java Packages and VIRSA components:
AC 5.3 Java SP15-SP21 can be used with VIRSANH SP16 to 22 (SP10-16 for 710/730) for those customers that are not able to upgrade both Java and ABAP stacks simultaneously.
Compatibility of Virsa 5.3 with Netweaver Releases:
- Is Virsa 5.3 compatible with Netweaver 7.4 (SAP_BASIS 740)?
- Implement the following SAP note to make 5.3 compatible with NW 740:
- 1918850 – GRC AC5.3 plug-in Compatabile for SAP_BASIS 740 release
- Implement the following SAP note to make 5.3 compatible with NW 740:
- VIRSAHR and VIRSANH is compatible with NW 730 from SP17 onwards.
- VIRSANH and VIRSAHR is compatible with NW 711 after implementation of 1675165 note.
Be aware that Virsa 5.3 will be out of maintenance from 31.12.2015.
From 5.3 to 10.0
If you are migrating from Virsa 5.3 to GRC 10.0 you need to know that:
- GRC 10.0 does not work with front-end Java anymore. The new GRC model is all based in ABAP and ABAP webdynpro
- A new model concept was adopted (Foundation system and plug-ins systems). The foundation centralizes the master data.
To those who use Virsa 5.3 and are migrating to a new GRC version (10.0 or 10.1), the following guides and KBAs can be used during the migration:
- Guide to migrate from 5.3 to 10.0
- You can also find in this guide, information on how to export data from 5.3 Risk Analysis and Remediation and Superuser Priviledge Management to GRC 10.0.
If you still need to use Java front-end and have installed GRCPINW in the back-end system, you will see that:
- GRCPINW overwrittes VIRSANH
- GRCPIERP overwrittes VIRSAHR
After support package 04 of GRCPINW, the 5.3 function modules are included (support package 04 of GRCPINW and GRCPÍERP is equivalent to VIRSANH Support package 16 and VIRSAHR Support package 14 respectively. As the front-end is still based on Java, the minimum SP level required for the front-end system is 15.
From 5.3 to 10.1
All GRC 10.1 Support packages have 5.3 code included.
This is stated in the following KBA:
- 1590030 – GRC 10.0, 10.1 Plug-in & AC 5.3 VIRSA (RTA) Co-Existence
Access Control 10.1 plugins are also supported with an Access Control 5.3 Java front end. You must be at minimum AC 5.3 SP22 for the front end and 10.1 SP07 for the plugin in order for this scenario to be supported.
Access Control 10.0
Below, you can find the most current support packages for GRC 10.0 (from SP 11 to SP 19) and their compatibility with components on the very left column.
PS: The support packages highlighted in green are relevant to GRCFND_A V1000.
|10.0 Support Packs|
|SP 14||SP 15||SP 16||SP 17||SP 18||SP 19||SP 20||SP 21||SP 22||SP 23|
|GRCPOR||No SP||SP 11||No SP||No SP||No SP||No SP||No SP||No SP||No SP||No SP|
|GRCACM||No SP||No SP||No SP||No SP||No SP||No SP||No SP||No SP||No SP||No SP|
|GRCPINW||SP 14||SP 15||SP 16||SP 17||SP 18||SP 19||SP 20||SP 21||SP 22||SP 23|
|GRCPIERP||SP 15||No SP||SP 15||SP 16||SP 17||SP 18||SP 19||SP 20||SP 21||SP 21|
|710 or 730|
|GRCPINW||SP 14||SP 15||SP 16||SP 17||SP 18||SP 19||SP 20||SP 21||SP 21||SP 22|
|GRCPIERP||Not Av.||Not Av.||Not Av.||Not Av.||Not Av.||Not Av.||Not Av.||Not Av.||Not Av.||Not Av.|
|731 or 740|
|GRCPINW||SP 05||SP 06||SP 07||SP 08||SP 09||SP 10||SP 11||SP 12||SP 13||SP 14|
|GRCPIERP||SP 14||No SP||SP 15||SP 16||SP 17||SP 18||SP 19||SP 20||Not Av.||SP 21|
* Prior to GRCFND_A SP10, the GRC system and all plug-in systems must be on the same support pack level. As of GRCFND_A SP10, backward compatibility has been introduced. Please refer to SAP Note https://css.wdf.sap.corp/sap/support/notes/1821368 for more details.
Compatibility of GRCFND_A V1000 with Netweaver Releases:
- GRC foundation is compatible with Netweaver 702 Support package 06 onwards;
- GRC foundation is also compatible with Netweaver 731 since GRCFND_A is on Support package 08;
- GRCPINW and GRCPIERP is compatible with NW 730 from SP05 onwards.
- GRCPINW and GRCPIERP are compatible with ECC 6.0 EHP7 (see requisites in SAP note 1820906)
Access Control 10.1
The below tables shows the Compatibility Matrix in GRC 10.1.
PS: The support packages highlighted in green are relevant to GRCFND_A V1100.
|10.1 Support Packs|
|SP 04||SP05||SP06||SP07||SP08||SP09||SP10||SP10||SP11||SP12||SP 13|
– Please see SAP Note 1855404. There was an issue with the SP10 package and SP11 needed to be created which caused the 731/740 GRCPINW SPs to be out of sync with GRCFND_A and GRCPIERP
– When importing GRCPINW V1100_731 from SP 10, system will request Support Package 11 to be applied (Using MOPZ or updating directly from SAINT/SPAM). System is picking up the correct support package. It means that SP 11 will be installed in 731 plug-ins systems when foundation is still on Support package 10.
For GRC 10.1 Foundation and GRC 10.1 Plugin systems, it is recommended to have both systems at the same level, however GRCFND_A 10.1 will be compatible with all 10.1 plugins as long as the plugin SP level is equal to or lower than the Foundation. (ex: GRCFND_A cannot be on SP02 while the plugin is on SP04).
Compatibility of GRCFND_A V1100 with Netweaver Releases:
Access Control 10.1 GRCFND_A needs to be installed on NW740 (at least Support package level 02) and it is compatible with GRCPINW (700, 710, 730, 731).
GRCPINW (GRCPINW_V1100_700) will be installed in a system with SAP_BASIS 700 with minimum SP level 13. The other versions will be installed following the same logic. You will
choose your GRC version based on your SAP_BASIS version. Eg: SAP_BASIS 702, GRCPINW V1100_700.
Information on Migration from GRC 10.0 to 10.1
You can connect to AC 10.0 Plug-in (GRCPINW & GRCPIERP) from AC 10.1 front-end as long as support pack of AC 10.0 plug-in is SP10 and above.
However, some new AC 10.1 functionalities such as Organization Rule Wizard, Custom User group creation and EAM DB log collection will not work.
What Databases work with GRC 10.1
(This information was brought by Kelly Ann Erickson):
First note that GRC 10.1 is installed only on SAP Netweaver systems beginning with SAP_BASIS version 740.
See installation guide for patch level needed for installation.
As for the database that works with SAP system, see the Product Availability Matrix to see which database versions are supported. GRC works with
whatever databases NW 7.40 supports.
- Go to Support Portal: https://support.sap.com/home.html
- Then navigate to Release, Upgrade & Maintenance Info > Product Availability Matrix. Click on orange box labeled Enter the Product Availability Matrix.
- Then click on Display all Product Versions. At the top is an open search field, enter SAP Access Control 10.1 and click on the results to view.
- Click on General Information > Related Product Versions. You will see a box labeled Required Product Versions. In that box scroll down to SAP NetWeaver 7.4 and click on it.
- In next screen Click on Technical Release Information and you will see Database Platforms on the menu bar. Click on it.
GRC 10.1 and Netweaver 7.5
GRC 10.1 (foundation system) is supported in NW 7.5 according to the following KBA:
The tables information was taken from:
- 1352498 – Support Pack Numbering – GRC Access Control
The Netweaver compatibility was taken from:
- 1680268 – Compatibility of Access Control Packages
The documenation was taken from:
- 1243085 – Available Documentation for GRC Access Control
The co-existance of components (5.3 and 10.0 or 10.1) was taken from:
- 1662113 – Using Access Control 5.3 with your 10.0 and 10.1 plug-in systems
The Migration from 10.0 to 10.1 was taken from:
- 1590030 – GRC 10.0, 10.1Plug-in & AC 5.3 Virsa (RTA) Co-Existence