Confused regarding BC sets

[Former Member]

Hi Experts,

I am quite confused regarding the BC sets.

I activated BC Sets, R3, HR, NHR, Basis, Common.(few of them activated with warnings). Now the Default functions, Risks will be populated. I can see most of the SAP delivered functions like AO01, AO02 etc dnt have any actions or permissions and some have actions like BA01 BA02 etc . When i checked the same in 5.3 i can see the actions in the same function. So did i performed any thing wrong while activation or it is the standard SAP function.

why is  the difference in actions in functions of 5.3 and 10.0 . hardly i can see the difference in the count of 5.3 functions and 10.0 functions and risks. Is there any way to know what extra delta added in 10.0.

I have gone through several Discussions in sdn. But dnt found this answer.

Regards,

RAvi.

[kevin_tucholke1 · Accepted solution]

Ravi:

The BC Sets that you activated contain the following:

Common - this contains Business Process entries, All Function IDs and Descriptions (shell info only), and the rule set (SAP delivers GLOBAL).

The different ruleset files (such as APO, R3, BASIS, etc) contains the Function Action,Function permissions, Risks for each individual area

R3 - the data for ALL Core R3 risks, this includes BASIS, HR and NHR.  So in effect you would either activate R3 or BASIS, HR and NHR individually as needed.  You will probably see that you have Connector Group SAP_R3_LG and SAP_BASIS_LG in the BASIS functions.  This is not necessary as you would only use one or the other.

BASIS, HR, and NHR contain the same as R3, but is broken up so to utilize the different rules for multiple systems in the Logical Group.  For example, BASIS would apply to ANY NetWeaver ABAP system (i.e PI, BW, ECC,...), in contrast, NHR (which contains Finance, Purchasing, Sales, Materials Management risks, would only be applicable to ECC.  This allows for greater flexibility for multiple types of systems for risk analysis.

In your question regarding APO, you would not see any items INSIDE the APO functions until you activate the APO Ruleset.

SAP puts out rule set updates periodically.  Depending upon when you loaded your original rule set, there have been changes (originally 2x per year, now only yearly).  You would need to find the relevant SAP Notes for these changes and review the attachments for the deltas.

Hope this helps.

Kevin Tucholke

Principal Consultant

SAP America

[Former Member · Accepted solution]

Hi kevin,

Thanks for the detailed information. It is very useful to understand the basics.

1.In R3 we have basis hr nhr. So its need nt to be activated again. In my case i have only single system. So eventhough i activated all the four. But no need to maintain the connector in all the connector groups. Only sap_r3_lg will serve the purpose. But if i keep the connector in all the connector groups(basis hr nhr) then will there any issue while generating rules??

2. i am doing upgrade from 5.3 to 10.0. So all the risks,functions,zrisks zfunctions updated to 10.0. Now i activated bc sets in expert mode. After dat when i noticed the zfunctions  dont contain any actions. And secondly functions with the same name will overwrite or append, because we had few standard functions with modified values. Will those functions get affected or only append of objects will happen. What happens to the zrisks will they overwrite or the functions associated with it will remain?

Regards,

Ravi

[kevin_tucholke1 · Accepted solution]

Ravi:

If you are using the Migration tool for moving your rule set, then you would not activate any RULESET BC sets.  The information would be coming from your export files instead.

My above answer should suffice for your second question as well.  If migrating the ruleset from 5.3, do not activate the equivalent RuleSet BC sets in AC 10.x.

If you maintain the connector in all 4 connector groups, then you will see Duplicate entries when you run the risk analysis.

Let me know if you have more questions.  Migration is not the easiest item to understand and if done incorrectly, can cause great pain.  Please be very detailed in what you are doing and review all items when you have migrated.

Thanks.

Kevin

[Former Member · Accepted solution]

Hi kevin,

Yes no need to activate bc sets if we do the migration. But here my client is askng wht extra is delivered in 10.0. So i took backup of the existing system and deleted the rules and  activated bc sets on the existing data. Here we are not able to see what exact is the delta in 5.3 and 10.0.

is it the correct way of doing?

is there any way to check what functions got modified or what extra is delivered in 10.0.

[Former Member · Accepted solution]

Hi Ravi,

There will certainly be new functions for auth. objects/fields belonging to GRC 10/10.1 box itself.

The other components: ECC , BI , etc. have remained the same. So, there will be not any new auth. objects/ fields introduced through GRC 10, for these components. They will be incldued , if you uograde any of these components, and do Rep. sync.

Regards

Plaban

[Former Member · Accepted solution]

Hi Plaban,

Thanks for the details. But when i analyzed the functions and risks in 5.3 and 10.0 Few of the Functions are extra in 5.3 it means they may be the custom functions created in 5.3 or else removed by SAP. From client side i am not getting any information regarding this. So i am assuming this data is the custom functions created by the client during the 5.3 implementation. I checked in BC Sets also but i dnt find any data regarding the below functions.

AP05,AP06, AP07, CC08, CC09, GL04, SA01, SA02..52 

Please let me know if my analysis is wrong.

Regards,

Ravi.

[Former Member · Accepted solution]

Hi Ravi,

i do not have 5.3, now. So, i am not able to see the functions. However, the functions of GRC 10 are of the type P2P203SC. So, the naming convention has changed.

So, could you compare the functions of your used rulesets. So, that you can focus on the required missing functions, if any.

regards

plaban

[Former Member · Accepted solution]

Hi Plaban,

Thanks for the reply.

What happens if we activate BC sets after rule generation.

ex. i have 100(90 standard+10 Custom) functions in 10.0. and i have activated the BC Sets now. so 90 functions got updated. What happens to the extra 10 functions. Now i observed that the 10 zfunctions dont have any actions or permissions after updating the BC Sets.

Generally the same function will be overwritten and the extra zfunctions should be as it is right.

Regards,

Ravi.