Download mitigating controls data from VIRSA CC 4.0 and upload in RAR 5.3
We have 3 systems and all are using the same rule set.
Now, in the upgrade guide, we can download the data from one VIRSA CC 4.0 system which will contain rule set and mitigating control data, and then upload it in RAR 5.3.
But in our case, we need to upload all 3 systems in RAR 5.3.
1) How do we upload the rulesets and mitigating controls of all THREE system and use a LOGICAL system to generate the rule set?
Please help as I can't find a detailed solution to this. SAP documents discussed the use of Logical System, but in the Upgrade guide, it doesn't show how we combine the data from the different systems. (The rule sets MUST be the same for all systems, which is true in our case, but the mitigating control data is different. The no. of mitigated users are different for all three systems!)
I hope somebody can help. Thank you.
Frank Koehntopp replied
a logical system is just a "virtual" system that allows you to maintain your function definition once and make it valid for all systems included in the virtual system.
So, as a first step (assuming your risk definition is identical for all three systems) you can create a logical system and add the three systems, then create risks where the function action / function permission mapping only has the logical system in them.
You will then have to export the mitigations and edit those files for upload (there's a lot of stuff that doesn't need to go in there, and it may be advisable to merge the data into one file). Make sure the risk ID matches the one for the logical system - if you have different risk IDs on the systems you have a lot of work on your hands Also, you might want to look for people that have the same control assigned two or three times and weed them out.