GRC AC 10.0 SAP_R3_LG,SAP_HR_LG and SAP_BAS_LG Rule sets comparison

[former_member184114]

Hi all,

I was wondering if anybody has done any kind of comparison and analysis on these different rule sets?

What I would like to know is SAP_R3_LG rule set contains risks for all SAP modules including HR and BASIS. Therefore, does it mean that risks for BASIS containing in SAP_R3_LG is as same as in SAP_BAS_LG?

Also does it meant that risks containing in SAP_HR_LG for HR module is as same as in risks in SAP_R3_LG for HR?

It means that:

Risks for HR system in SAP_R3_LG = Risks for HR system in SAP_HR_LG

Risks for BASIS system in SAP_R3_LG = Risks for BASIS system in SAP_BAS_LG

Risks for other modules' system in SAP_R3_LG = Risks for other modules' system in SAP_NHR_LG

In which scenarios these different rule sets actually are used?

Please share your views and help me understand this in full.

Regards,

Faisal

[Colleen]

Hi Faisal

I take it to mean that the rule set SAP_R3_LG whilst the others are subsets of it.

But for me, I'll activate the entire SAP Sets (ie. exclude non-SAP components) and then export them to Excel to Review and maintain as required.

If you have multiple components in your landscape and separate HR to finance you might want to activate a only a subset of the total rules as the Finance Actions may not apply in HR component and vice versa.

You can always extract the data from the BC sets and compare (unless someone from SAP jumps in here).

Regards

Colleen

[former_member184114]

Hi Colleen,

Thanks for your input and sharing your thoughts.

Even I am of the same opinion. In our ERP sytems landscape, HR and all other modules are configured. What do you think should I activate:

1. SAP_R3_LG - Since I have all the modules available

2. SAP_HR_LG- Since HR module is there

3. SAP_NHR_LG- Since all non-HR modules are available (including BASIS)

I am trying to figure out what will be the best solution here because I dont see any difference except, I will have to maintain all my ERP sytems in each LG, which is a repetitive task. Instead I feel that if I active SAP_R3_LG and maintain all ERP systems in this one LG, it covers all of them.

Please suggest and help me design proper solution. I dont feel any added advantage except system maintenance in each LG.

Regards,

Faisal

[Colleen]

Hey Faisal

If you really want to know the difference - Activate all of them as they are a set for each logical system. Extract the Table with Function to Action Mapping as it will contain the Logical Group as Transaction. Export it to MS Excel and do a pivot. You can then see what the overlaps are on the transaction. This assumes the permission mappings are the same for each definition

With this comparison, you can always delete the rule set and activate BC Set again or whatever you need to do.

End of the day, if these are the logical connectors you will map your system to one of them. So you if in doubt, choose SAP_R3_LG and then maintain the sets

I think you choose one of the *LG to map your system to that is the most appropriate.

Regards

Colleen

[former_member184114]

Colleen,

Thanks for sharing your thoughts on this.

I might do this comparison activity sometime later. As of now, I am going to use SAP_R3_LG to start with.

Let me see what difference they have after comparing.

Regards,

Faisal

[former_member184114]

Thanks!