GRC AC 10.1 - Rule ID Mismatch Post Upgrade

[Former Member]

Hello

We just upgraded from AC 5.3 to 10.1 and are going through the process of assigning our mitigating controls to rule IDs. This process has become tedious since the rule IDs do not match between 5.3 and 10.1. As of now we are manually identifying the assigned risks and transaction codes for one rule in 5.3. We take the risk and transaction code information and look for the same match in 10.1 to find the new rule ID for the mitigating control to be assigned to. This is quite time consuming which makes us feel there must be a better way to do this. I know there is a way to upload mass user and role assignment but is there a way upload rule ID / mitigation control assignment? Can anyone recommend a good way to compare mitigating controls assigned to rule IDs when the rule IDs are different?

Any assistance is appreciated.

[alessandr0]

Dear Stacey,

did you check the following document?

http://scn.sap.com/docs/DOC-55082

It is possible to upload mitigation assignments with rule ID.

For comparision I recommend to use Excel with VLOOKUP.

Regards,

Alessandro

[Former Member]

Hello

Thank you for the quick response. I have reviewed the post you referenced but it is related to mass mitigation of users, roles and profiles. We are looking to map the old rule Ids from 5.3 with the new rule IDs from 10.1 which, correct me if I'm wrong, isn't covered in the article you provided.

Do you have any recommendations on vlookup? In order to concatenate we the risk and functions we would need to get all functions assigned to a risk in one line since they are now listed separately.

Thank you!