What is the use of Rule ID for access risk in mitigation control ?

[Former Member]

Hi Experts,

Could you please advice the importance and usages of Rule ID (Against risk ID ) in access risk tab while creating Mitigation control ?

What will be impact if we leave this blank.

Is there any table or report for rule ID ?

Screenshot attached.

GRC version : GRC 10.1 . SP12

[Former Member · Accepted solution]

Hi Rajesh,

If you need to apply mitigation for specific Rule ID wrt access risks then you need to maintain the Rule ID's.

Set the Rule ID as * so that the application will include all rules when mitigating access risks.

This is controlled through parameter 1012(Consider Rule ID also for mitigation assignment) and the default value is NO.

Table GRACACTRULE will give you the generated rules based on the Risk ID.

Regards,

Manju

[Former Member · Accepted solution]

My understanding is :

1. Rule ID is a combination of tcode automatically created in system.

2. To uniquely identify combination of conflicting tcode we use Risk ID & Rule ID.

3. The rule ID can be associated with multiple Risk ID.

[Former Member · Accepted solution]

Hi Rajesh,

Please find the response below

1. Rule ID can be a combination of Actions(Tcodes) and Permissions(Objects) for a Risk

2. Uniquely identify conflicting Tcodes and Objects

3. YES

Regards,

Manju

[Former Member · Accepted solution]

Thanks Manju !!!