Skip to Content

This is a guide to provide compatibility between GRC components in all GRC systems. As there are many questions raised regarding compatibility of GRC with plug-ins, SAP_BASIS versions and enhancement packages, I decided to put this information all together in one single guide. Starting from Virsa to GRC 10.1.

Search for compatibility information in service.sap.com/pam

Table of contents

 

Virsa 4.0


 

This version of virsa is out of maintainance since 15.03.2014.

Access the Migration Guide if you want further instructions on how to move from 4.0 to 10.0.

If you want to know what will be migrated:

Access Control 4.0 Migration to v10.0 – Governance, Risk and Compliance – SCN Wiki

Compatibility of Virsa 4.0 with Netweaver Releases:

  • 2072255 – Is VIRSA 4.0 Supported on EHP 7?

 

Virsa 5.3


 

Compatibility of Java Packages and VIRSA components:

AC 5.3 Java SP15-SP21 can be used with VIRSANH SP16 to 22 (SP10-16 for 710/730) for those customers that are not able to upgrade both Java and ABAP stacks simultaneously.

Compatibility of Virsa 5.3 with Netweaver Releases:

  • Is Virsa 5.3 compatible with Netweaver 7.4 (SAP_BASIS 740)?
    • Implement the following SAP note to make 5.3 compatible with NW 740:
      • 1918850 – GRC AC5.3 plug-in Compatabile for SAP_BASIS 740 release
  • VIRSAHR and VIRSANH is compatible with NW 730 from SP17 onwards.
  • VIRSANH and VIRSAHR is compatible with NW 711 after implementation of 1675165 note.

Be aware that Virsa 5.3 will be out of maintenance from 31.12.2015.

 

From 5.3 to 10.0


If you are migrating from Virsa 5.3 to GRC 10.0 you need to know that:

  • GRC 10.0 does not work with front-end Java anymore. The new GRC model is all based in ABAP and ABAP webdynpro
  • A new model concept was adopted (Foundation system and plug-ins systems). The foundation centralizes the master data.

To those who use Virsa 5.3 and are migrating to a new GRC version (10.0 or 10.1), the following guides and KBAs can be used during the migration:

  • Guide to migrate from 5.3 to 10.0
    • You can also find in this guide, information on how to export data from 5.3 Risk Analysis and Remediation and Superuser Priviledge Management to GRC 10.0.

If you still need to use Java front-end and have installed GRCPINW in the back-end system, you will see that: 

  • GRCPINW overwrittes VIRSANH
  • GRCPIERP overwrittes VIRSAHR

After support package 04 of GRCPINW, the 5.3 function modules are included (support package 04 of GRCPINW and GRCPÍERP is equivalent to VIRSANH Support package 16 and VIRSAHR Support package 14 respectively. As the front-end is still based on Java, the minimum SP level required for the front-end system is 15.

From 5.3 to 10.1


 

All GRC 10.1 Support packages have 5.3 code included.

This is stated in the following KBA:

  • 1590030 – GRC 10.0, 10.1 Plug-in & AC 5.3 VIRSA (RTA) Co-Existence

Access Control 10.1 plugins are also supported with an Access Control 5.3 Java front end. You must be at minimum AC 5.3 SP22 for the front end and 10.1 SP07 for the plugin in order for this scenario to be supported.

 

Access Control 10.0


Below, you can find the most current support packages for GRC 10.0 (from SP 11 to SP 19) and their compatibility with components on the very left column.

 

PS: The support packages highlighted in green are relevant to GRCFND_A V1000.

10.0 Support Packs
GRCFND_A V1000
SP 14 SP 15 SP 16 SP 17 SP 18 SP 19 SP 20 SP 21 SP 22 SP 23
GRCPOR No SP SP 11 No SP No SP No SP No SP No SP No SP No SP No SP
GRCACM No SP No SP No SP No SP No SP No SP No SP No SP No SP No SP
700
GRCPINW SP 14 SP 15 SP 16 SP 17 SP 18 SP 19 SP 20 SP 21 SP 22 SP 23
GRCPIERP SP 15 No SP SP 15 SP 16 SP 17 SP 18 SP 19 SP 20 SP 21 SP 21
710 or 730
GRCPINW SP 14 SP 15 SP 16 SP 17 SP 18 SP 19 SP 20 SP 21 SP 21 SP 22
GRCPIERP Not Av. Not Av. Not Av. Not Av. Not Av. Not Av. Not Av. Not Av. Not Av. Not Av.
731 or 740
GRCPINW SP 05 SP 06 SP 07 SP 08 SP 09 SP 10 SP 11 SP 12 SP 13 SP 14
GRCPIERP SP 14 No SP SP 15 SP 16 SP 17 SP 18 SP 19 SP 20 Not Av. SP 21

* Prior to GRCFND_A SP10, the GRC system and all plug-in systems must be on the same support pack level. As of GRCFND_A SP10, backward compatibility has been introduced. Please refer to SAP Note https://css.wdf.sap.corp/sap/support/notes/1821368  for more details.

Compatibility of GRCFND_A V1000 with Netweaver Releases:

  • GRC foundation is compatible with Netweaver 702 Support package 06 onwards;
  • GRC foundation is also compatible with Netweaver 731 since GRCFND_A is on Support package 08;
  • GRCPINW and GRCPIERP is compatible with NW 730 from SP05 onwards.
  • GRCPINW and GRCPIERP are compatible with ECC 6.0 EHP7 (see requisites in SAP note 1820906)

Click Here to check what’s new in GRC 10.0.

Access Control 10.1


The below tables shows the Compatibility Matrix in GRC 10.1.

PS: The support packages highlighted in green are relevant to GRCFND_A V1100.

10.1 Support Packs
GRCFND_A V1100
SP 04 SP05 SP06 SP07 SP08 SP09 SP10 SP10 SP11 SP12 SP 13
700
GRCPINW SP04 SP05 SP06 SP07 SP08 SP09 SP10 SP10 SP11 SP12 SP 13
  GRCPIERP SP04 SP05 SP06 SP07 SP08 SP09 SP10 SP10 SP11 SP12 SP 13
710/730
  GRCPINW SP04 SP05 SP06 SP07 SP08 SP09 SP10 SP10 SP11 SP12 SP 13
  GRCPIERP SP04 SP05 SP06 SP07 SP08 SP09 SP10 SP10 SP11 SP12 SP 13
731/740
  GRCPINW SP04 SP05 SP06 SP07 SP08 SP09 SP10 SP11 SP12 SP13 SP 14
  GRCPIERP SP04 SP05 SP06 SP07 SP08 SP09 SP10 SP10 SP11 SP12 SP 13

Important Information:

– Please see SAP Note 1855404. There was an issue with the SP10 package and SP11 needed to be created which caused the 731/740 GRCPINW SPs to be out of sync with GRCFND_A and GRCPIERP

– When importing GRCPINW V1100_731 from SP 10, system will request Support Package 11 to be applied (Using MOPZ or updating directly from SAINT/SPAM). System is picking up the correct support package. It means that SP 11 will be installed in 731 plug-ins systems when foundation is still on Support package 10.

For GRC 10.1 Foundation and GRC 10.1 Plugin systems, it is recommended to have both systems at the same level, however GRCFND_A 10.1 will be compatible with all 10.1 plugins as long as the plugin SP level is equal to or lower than the Foundation. (ex: GRCFND_A cannot be on SP02 while the plugin is on SP04).

 

Compatibility of GRCFND_A V1100 with Netweaver Releases:

Access Control 10.1 GRCFND_A needs to be installed on NW740 (at least Support package level 02) and it is compatible with GRCPINW (700, 710, 730, 731).

GRCPINW (GRCPINW_V1100_700) will be installed in a system with SAP_BASIS 700 with minimum SP level 13. The other versions will be installed following the same logic. You will
choose your GRC version based on your SAP_BASIS version. Eg: SAP_BASIS 702, GRCPINW V1100_700.

Click Here to know what’s new in GRC 10.1.

Information on Migration from GRC 10.0 to 10.1


You can connect to AC 10.0 Plug-in (GRCPINW & GRCPIERP) from AC 10.1 front-end as long as support pack of AC 10.0 plug-in is SP10 and above.

However, some new AC 10.1 functionalities such as Organization Rule Wizard, Custom User group creation and EAM DB log collection will not work.

 

What Databases work with GRC 10.1


 

(This information was brought by Kelly Ann Erickson):

First note that GRC 10.1 is installed only on SAP Netweaver systems beginning with SAP_BASIS version 740.

See installation guide for patch level needed for installation.

As for the database that works with SAP system, see the Product Availability Matrix to see which database versions are supported.  GRC works with

whatever databases NW 7.40 supports.

  1. Go to Support Portal: https://support.sap.com/home.html
  2. Then navigate to Release, Upgrade & Maintenance Info > Product Availability Matrix. Click on orange box labeled Enter the Product Availability Matrix.
  3. Then click on Display all Product Versions. At the top is an open search field, enter SAP Access Control 10.1 and click on the results to view.
  4. Click on General Information > Related Product Versions.  You will see a box labeled Required Product Versions.  In that box scroll down to SAP NetWeaver 7.4 and click on it.
  5. In next screen Click on Technical Release Information and you will see Database Platforms on the menu bar.  Click on it.

GRC 10.1 and Netweaver 7.5


GRC 10.1 (foundation system) is supported in NW 7.5 according to the following KBA:

2308327 – Is GRC 10.1 also supported for Netweaver 7.5?

References


The tables information was taken from:

  • 1352498 – Support Pack Numbering – GRC Access Control

The Netweaver compatibility was taken from:

  • 1680268 – Compatibility of Access Control Packages

The documenation was taken from:

  • 1243085 – Available Documentation for GRC Access Control

The co-existance of components (5.3 and 10.0 or 10.1) was taken from:

  • 1662113 – Using Access Control 5.3 with your 10.0 and 10.1 plug-in systems

The Migration from 10.0 to 10.1 was taken from:

  • 1590030 – GRC 10.0, 10.1Plug-in & AC 5.3 Virsa (RTA) Co-Existence
To report this post you need to login first.

30 Comments

You must be Logged on to comment or reply to a post.

  1. Felipe Prasniski

    Great work Fernando!

    There are a lot of doubts when it comes to version and compatibility between AC and NW, this is indeed a very useful one stop that should solve many questions!

    (0) 
  2. Martin English

    Hi Fernando,

    I’m having a problem interpreting the purpose of the compatibility tables and what they tell me. For example, my customer has GRCFND_A V1000 SP16, with a plugin of GRCPIERP V1000_700 SP13

    On your Access Control 10.0 table, if I go to the GRCFND_A SP16 column, then drop down to the 700 / GRCPIERP row, I see SP15. Is SP15 the minimum or maximum or only SP level of GRCPIERP V1000_700 that is compatible with GRCFND_A V1000 SP16 ?

    or, given that SAP Note 1821368 says the following…

    In other words, once the plug-in is on SP10, the GRC add-on GRCFND_A can be upgraded to SP11 or higher without upgrading the plug-in.

    … since both GRCFND_A and the plug-in are higher than SP10, is everything OK ?

    thanks

    (0) 
    1. Fernando Bassuino Post author

      Hello Martin,

      On the access control matrix, I mentioned the “perfect match” between Foundation and plug-in components and their support package levels. Two main things to consider:

      1. Ensure that GRCFND_A SP level is always higher or at the same level comparing to GRCPINW or GRCPIERP.

      2. Ensure that they are above SP 10 so the plug-ins have backwards compatiblity.

      In your case, the two sentences above are true, meaning that your scenario will work perfectly fine.

      Have a good day ahead,
      Fernando

      (0) 
      1. Martin English

        Fernando Bassuino wrote:

        ……..

        In your case, the two sentences above are true, meaning that your scenario will work perfectly fine.

        Oh, if only that were true. But at least you’ve helped eliminate one line of inquiry 🙂

        thanks

        (0) 
  3. Fernando Diaz Colodrero

    Congratulations Fernando! Your post is excellent!

    I have a question for a client and maybe you can help me.

    We have implemented Access Control 10.1 (SP10) and now we have a requirement to create a connector for a new SAP system. The thing is that this system is on a SAP Basis 4.6C (SP33).

    As I could see in SAP Note 1821368 and in your blog, it would be possible to implement plug-in for AC 10.0 but with some limitations. So, do you know which SP level should we implement to align plug-in from AC 10.0 to AC 10.1 SP10? The last available is SP12 released on 26.03.2013.

    Thanks in advance!

    Fernando

    (0) 
    1. Fernando Bassuino Post author

      Hello Fernando, Thank you!!! 🙂 As SAP_BASIS 46C is out of maintenance for a long time, they decided to maintain for 10.0 plug-ins. For 10.1, there is no integration between a GRC 10.1 and 46C plug-ins. The plug-in (GRCPINW V1100_46C) does not exist for this version. Best Regards, Fernando Bassuino

      (0) 
      1. José González Lázare

        Hi Fernando,

        I am wonderinf if it would be possible to keep installed in 46C the 10.0 plugin and use it against a 10.1. What do you think?

        I know this could cause some issues but this approach does work for ECC 6.0. If this is the case, would be better than just keep a GRC environment in 10.0 only for this incompatibility.
         

        (0) 
  4. t suresh

    Hi, Fernando,

    I installed GRC 10.1 Add-ons and I need to confirm the ERP backend systems Plug-ins

    like ERP,CRM,PI,Solman systems.

    I find out GRCPIERP_V1100.

    Regards

    Suresh

    (0) 
    1. Fernando Bassuino Post author

      Hello Suresh, The GRC plug-ins are dependant of the SAP_BASIS and Foundation version and support package levels. CRM, PI and SOLMAN systems have their own supportability levels. Could you please specify what exactly are you looking for? Do you wish to install GRCPIERP? Best Regards and Happy New Year!! Fernando

      (0) 
      1. t suresh

        Hi Fernando,

        Thanks for your reply.

        I installed GRCPINW/GRCPIERP plugins in backend systems.

        I need more inform about backend systems like CRM,SOLMAN,PI,BW systems add-ons and plug-ins.

        Regards

        Suresh

        (0) 
          1. t suresh

            Hi Fernando,

            Iam planning to activate BC sets for GRC 10.1 Access Control and Risk Management. Can you please help on which are the standard SAP BC sets for AC and RM.

            Regards

            Suresh

            (0) 
  5. Madhubrata Mohapatro

    Hi Fernando,

    Thanks for this blog. Is really helpful for GRC 10.1 info. But I need some more info on Plug-in upgrade in the backend systems, if possible please help.

    I have referred the Notes given by you.

    We are upgrading from GRC10 to GRC 10.1 ( SPS 12 ). So need to upgrade the plug-ins in the backend systems as well.

    But I have SCM system on NW 7.01 and there is GRCPINW V1000_700 SP12. We are upgrading the SPS for this system, so want to upgrade the GRCPINW to V1100_700. I found a exchange upgrade pack for this version and the V1100_700 maintenance SPS12 packs. But during creation of my xml, it does not allow me to chose for this plugin uograde from 10 to 10.1 release.

    Can you please let me know if this upgrade is compatible. and is there a clear information on upgrade paths for plugins, 1855404 is not so clear to me.

    Thanks in advance.

    (0) 
    1. Fernando Bassuino Post author

      Hello Madhubrata,

      Sorry, Just saw your comments now. Still need help with that scenario?

      What is the message system is giving? Are you upgrading from SAINT, SPAM, MOPZ?

      Thanks, Fernando

      (0) 
  6. Madan Reddy

    Hi Fernando,

    Firstly this blog has lot of useful information which really helped us with the queries we have regarding SP upgrade.

    We are planning to upgrade the GRC access control patch level from SP5 to SP14. We wanted to check if we need to upgrade our java stack as well but could not find any relevant details or SAP notes.

    Please share if you have any details. We have raised OSS message as well for this 😯

    Thanks in advance

    ~ Madan

    (0) 
    1. Fernando Bassuino Post author

      Hi Madan,

      Thanks! 🙂

      No need to upgrade the java server for a GRC upgrade. The only functionality that is attached to a Java Server is the ADS (Adobe).

      Regards,

      Fernando

      (0) 
  7. Artem Ivashkin

    Hello Fernando,

    I’ve found that there is a mistake in your table with SP levels for Plugin system. There is no SP22 for GRCPIERP.

    The latest available is SAPK-10321INGRCPIERP GRCPIERP V1000_700: Support Package 0021 (path:

    • SAP ACCESS CONTROL 10.0 (SUPPORT PACKAGES AND PATCHES)/
    • ENTRY BY COMPONENT/
    • PLUG-IN ON SAP ERP 6.0/
    • SAP GRC 10.0 PLUGIN ERP 7.00)

    Seems that GRCPINW has overlapped GRCPIERP one more time 🙂

    Regards,

    Artem

    (0) 
  8. Douglas Helm

    Where can I find the note that contains the latest Compatibility Matrix Table view for Plug-ins to GRCFND_A V1100?

    Also, does ECC EhP8 SPS5 on NW 7.5 require a specific level of GRCPINW patches be applied?  I ask because we were not planning to patch our GRC components but the NW Plugin is getting added with EhP8 automatically.

    (0) 
  9. Rajashekar BC

    Dear Fernando, As always your posts are coliseum.
    Please share insight from perspective of Superuser privilege management – 5.3 and it’s co – existenance with GRC 10.1 front-end (GRCFND_A) and back-end plug-in (GRCPINW & GRCPIERP) components and SAP_BASIS. Specifically if GRCFND_A Release V1100 – Service Pack 0008 is planned to be upgraded Service Pack 0017?

    Thanks

    (0) 

Leave a Reply