SAP RM AVM README README V1.0 SAP RM AVM Readme... 1 Purpose... 1 Overview... 2 Navigation Path for Software and Documents download... 2 Base Installation Package... 2 Support Packs... 2 RM AVM Component Details... 3 RCM... 6 Pre-requisite... 6 New Installation... 6 Related Documents... 7 AVM-RTA DS... 7 Pre-requisite... 7 New Installation... 7 Related Documents... 7 AVM-LaserFocus... 8 Pre-requisites... 8 New Installation... 8 Upgrade Installation... 8 Enhancements... 11 Fixed Issues... 14 Mandatory Guidelines... 14 Related Documents... 15 Revision History... 16 Purpose This readme file describes detail information about RM_v1.0 build. This build comprises two components as RCM v1.5sp11 and AVM v1.0sp04. The AVM v1.0sp04 contains two components as AVM-LaserFocus v3.1sp06, AVM-RTADS2.0SP04-02 build and Documents.
Overview Greenlight delivers the necessary files to install the RM (Regulatory Management) as a bundled package for installation on the server. RM (Regulation Management) application consists of two components RCM (Regulatory Change Management). Access Violation Management (AVM) application consists of AVM- RTA DS and AVM- LaserFocus. 1. RCM (Regulatory Change Management) is software component that enables unified compliance management capabilities for normalizing, assessing and processing disparate regulatory authorities and requirement revisions. 2. AVM-RTA DS (Real Time Adaptor Design Studio) is a software component that extends the SAP GRC applications for Access Control (AC) and Process Control (PC) to non-sap systems in the customer s IT landscape. 3. AVM-LF (LaserFocus) software component that compliments SAP GRC Access Control reporting capabilities and helps users to perform remediation in a systematic and accelerated way. Note: AVM- RTA DS and AVM-LaserFocus was previously referred as RTA DS and LaserFocus respectively. Navigation Path for Software and Documents download Software package and documentation for SAP Regulation Management by Greenlight SAP Access Violation Management by Greenlight can be accessed as following - Base Installation Package 1. Go to https://support.sap.com/software/installations.html 2. Customers licensed for AVM can navigate to Browse our download catalog -> SAP Solution Extensions by Partners -> SAP A V MGT BY GREENLIGHT -> SAP A V MGT 1.0 BY GREENLIGHT -> Installation. 3. Customers licensed for RM can navigate to Browse our download catalog -> SAP Solution Extensions by Partners -> SAP REG MGMT BY GREENLIGHT -> SAP REG MGMT 1.0 BY GREENLIGHT -> Installation. Support Packs 1. Go to https://support.sap.com/software/patches.html 2. Customers licensed for AVM can navigate to Browse our download catalog > SAP Solution Extensions by Partners > SAP A V MGT BY GREENLIGHT > SAP A V MGT 1.0 BY GREENLIGHT > Download Component specific relevant Support pack. 3. Customers licensed for RM can navigate to Browse our download catalog > SAP Solution Extensions by Partners > SAP REG MGMT BY GREENLIGHT > SAP REG
MGMT 1.0 BY GREENLIGHT > Download Component specific relevant Support pack. Documentation Documentation can be accessed from path below. SAP service Marketplace > Products > Installation & Upgrade Guides > SAP Solution Extensions > Greenlight > SAP RM1.0 and AVM1.0 RM AVM Component Details Current RM 1.0 build contains following components: Figure 1.0: Build CurrentAVM1.0SP04 build contains following components: Figure 1.1: Build 1. RCM 1.5 SP01 support pack contains: a. Build: this folder contains following build files. i. glt.com~rcmear.ear ii. glt.com~rcmactn.ear iii. glt.com~rcmdatadictionary.sda iv. glt.com~wrkflear.ear v. Uwl.ear b. MasterData: this folder contains following file. i. MasterData.csv c. Scripts: this contains scripts for workflow tables and scheduler scripts for RCM. d. Jarfile: it contains Oracle JDBC jar file.
e. UMEROLE: this folder contains RCM_UME_Users_Roles.txt f. Workflows: this folder contains following folder. i. 49.0: this folder contains: _maven.repositories workflow-49.0.pom workflow-49.0.jar ii. 50.0: this folder contains: _maven.repositories workflow-50.0.pom workflow-50.0.jar 2. LASERFOCUS 2.0 SP 04 support pack contains: a. The Build: folder contains LaserFocus3.1SP06_20150821.sca b. The DB Agent: this folder contains i. glt_ld_agent_v1.5sp01.tar.gzip ii. glt_ld_extract_v1.5sp01.sh Note: Deployment of this agent component is required to Mitigation Control execution where in data for one or more systems is available in Flat File. c. The Scripts: this folder contains: i. LF3.1SP06_BO_Migrate_1.sql ii. LF3.1SP06_BO_Migrate_2.sql iii. LF3.1SP06_UserMitigation_SetRiskDefaultValues_Configuration.sql iv. Quartz_script_Oracle.sql d. The UME Roles: folder contains LF_UME_Users_Roles_7_3.txt file having predefined roles to login to LaserFocus. 3. RTADS 2.0 SP01 support pack contains: a. Build: this folder contains RTADS_2.0.SP04_02.sca b. License: this folder contains GLT_RTADS_APPL.XML, GLT_RTADS_PLAT.XML and GLT_RTADS_SYS.XML. c. Metadata: this folder contains MASTERDATA_2.0SP04-02.xml d. Scripts: this folder contains DeleteScript.sql and InstallScript.sql e. Ume: this folder contains rtads_ume_roles.txt. 4. Documents a. SAP_RM_AVM_User_Guide_v1.0.pdf- this document provides familiarizes user about RM application and its components RCM and AVM (AVM- RTA DS and AVM-LaserFocus).
b. SAP_RM_AVM_Installation_Guide_v1.0.pdf- this document provides step- by step explanation for the installation of RM components (RCM and AVM- RTA DS and AVM-LaserFocus). c. SAP_RM_AVM_Configuration_Guide_v1.0.pdf- this document provides stepby step explanation of configuring RM components (RCM and AVM- RTA DS and AVM-LaserFocus). d. SAP_RM_AVM_Security_Guide_v1.0.pdf- this document provides details of the security-relevant information that applies to RM application. e. SAP_RM_AVM_ReadMe_v1.0.pdf- this ReadMe file describes the details of RM v1.0 build. RM Build contains RCM and AVM. RCM contains RCM 1.5SP11. AVM build contains two components- LaserFocus v3.1sp06 build and RTADS2.0SP04-02 build. f. SAP_RM_AVM_Base_Add-On_Installation_Guide_for ECC_GRC_v1.0.pdf- This guide provides step by step instruction on deployment ECC Add on Support Package and GRC Add on Support Package for AVM-LF and GRC Add on Support Package for RCM. g. ECC_Add-On_Support_Package_Installation_Guide_v1.0SP03.pdf- This guide provides step by step instruction on deployment of AVM-LaserFocus ECC Support Package. h. AVM_Sizing_Document_v1.0SP03.pdf-This document provides the sizing guidelines and system requirements to deploy Access Violation Management (AVM) 1.0 on SAP NetWeaver. i. AVM_Mitigation_Control_Reference_Guide_v1.0SP03.pdf-This document provides detailed information about risks along with the functions, joining conditions, execution sequences and the input parameter details. j. AVM_Mitigation_Control_Functional_Specification_Guide_v1.0SP03.pdf- This document provides functional specification details of all the functions used for mitigation controls. k. AVM_Control_Validation_Guide_v1.0SP03.pdf-This document provides details to perform validation of SoD controls. It helps to identify which hard hits should be reported when controls are executed during testing, once per each SoD risk execution or as needed. l. SAP_Automated_Controls_ReadMe_v1.0SP03.pdf- This ReadMe explains execution steps to configure 50 mitigation controls. m. LaserFocus_GRC_Add-On_Support_Package_Installation_Guide_v1.0.pdf- This guide provides step by step instruction on deployment of LaserFocus Add- On Support Package. n. DB_Agent_File_Upload_Guide_v1.5SP01.pdf-This guide provides step-by-step instructions to install and configure the DB Agent component for File Upload.
RCM This section describes installation details of RCM component. Pre-requisite 1. Download the RCM software from navigation path provided above. Note: 1. RCM requires core java component and GRC ABAP Add On component. 2. For core Java component always install latest support pack available on SMP. 3. For ABAP Add On, first install base Add-On followed by all the relevant support packs. 2. Ensure that GRC Add-On Support Package is installed. For more information on GRC support package installation refer, SAP_RM_AVM_Base_Add- On_Installation_Guide_for ECC_GRC_v1.0.pdf and SAP_RM AVM_LaserFocus_GRC_Add-On_Support_Package_Installation_Guide_v1.0.pdf 3. Workflow jar files should be copied on specified location on NW Java server. For more information about workflow jar files, refer SAP_RM_AVM_Installation_Guide_v1.0.pdf- section 3.1 Copy Workflow files from folder. 4. Ensure that share folder is created for index generation which should be accessible through all the NW Java server nodes. New Installation For RCM, you need to install workflow application before deploying RCM application. 1. For Workflow application installation, refer: SAP_RM_AVM_Installation_Guide_v1.0.pdf- Chapter 3 RCM Workflow Installation. 2. For first time installation of the RCM application, refer: SAP_RM_AVM_Installation_Guide_v1.0.pdf - chapter 3 AVM RTA Design Studio Installation- section 3.1.2 ON SAP NW 7.31 THROUGH JSPM 3. Deploy SAP RM AVM- Base Add-on component for GRC. For additional instructions on GRC Add-On support package deployment, refer: SAP_RM_AVM_Base_Add- On_Installation_Guide_for ECC_GRC_v1.0.pdf 4. Deploy all the relevant SAP RM AVM GRC support packs. For more information, refer SAP_RM AVM_LaserFocus_GRC_Add- On_Support_Package_Installation_Guide_v1.0.pdf
Related Documents The list of related document is as follows: 1. SAP_RM_AVM_User_Guide_v1.0.pdf- for more information on how to use RCM application, refer: Chapter 2 to 8. Section 38.1 2. SAP_RM_AVM_Installation_Guide_v1.0.pdf- for more information on workflow and RCM application installation, refer: chapter 3 and chapter 4. 3. SAP_RM_AVM_Configuration_Guide_v1.0.pdf- for more information on RCM configuration, refer: Chapter 3. 4. SAP_RM_AVM_Base_Add-On_Installation_Guide_for ECC_GRC_v1.0.pdf 5. SAP_RM_AVM_LaserFocus_GRC_Add- On_Support_Package_Installation_Guide_v1.0.pdf AVM-RTA DS This section describes installation details of AVM-RTA DS component. Pre-requisite Download the AVM-RTA DS software from navigation path provided above. Note: 1. AVM-RTA DS requires core java component. 2. For core Java component always install latest support pack available on SMP. New Installation 1. For first time installation of the AVM-RTA DS application, refer: SAP_RM_AVM_Installation_Guide_v1.0.pdf- chapter 5 AVM RTA Design Studio Installation- section 5.1.2 ON SAP NW 7.31 THROUGH JSPM Related Documents The list of related document is as follows: 1. SAP_RM_AVM_Installation_Guide_v1.0.pdf for more information on AVM- RTA DS installation and other details, refer section 2.3, Chapter 5, 7, 8 and section 9.1 2. SAP_RM_AVM_Configuration_Guide_v1.0.pdf - for more information on AVM- RTA DS configuration refer section 2.1 and Chapter 4. 3. SAP_RM_AVM_User_Guide_v1.0.pdf- for more information on how to perform various tasks in AVM- RTA DS, refer Chapter 9 to 21 and section 38.1
AVM-LaserFocus This section describes installation details of AVM-LaserFocus component. Pre-requisites 1 Download the AVM-LaserFocus software from navigation path provided above. Note: 1. AVM-LaserFocus requires core java component and ABAP Add On components for ECC and GRC. 2. For core Java component always install latest support pack available on SMP. 3. For ABAP Add On, first install base Add-On followed by all the relevant support packs. 2 If AVM- LaserFocus application is deployed, undeploy it. Else, ignore the steps. 3 The user should have sufficient technical knowledge and access permissions for the Net Weaver Java Stack as well as the following applications. a. SAP Software Deployment Manager, JSPM or SUM. b. SAP Visual Administrator and SAP NWA. c. SAP Configuration Tool 4 Before upgrading, ensure that AVM-LF 3.1 SP05 is deployed. New Installation 1. For first time installation, refer SAP_RM_AVM_Installation_Guide_v1.0.pdfrefer: Section 2.4 and Chapter 6 AVM- LaseFocus Installation, section 6.1.2 On SAP NW AS Java 7.31 through JSPM and follow the given steps. 2. For more information on AVM-LaserFocus Configuration, refer SAP_RM_AVM_Configuration_Guide_v1.0.pdf- section 2.4 and chapter 5 AVM- LaserFocus Configuration. 3. Deploy Base Add-on component for ECC and GRC. For additional instructions on Add-On Deployment, refer: SAP_RM_AVM_Base_Add- On_Installation_Guide_for ECC_GRC_v1.0.pdf Upgrade Installation Note: before upgrading, ensure that no LaserFocus jobs are in process. 1. Please take backup of from below location.
a. It is important to take the backup of the attachment folder before we start the deployment process. Please follow below steps. Take the backup of the folder for which the path is configured from User Mitigation>Configuration>Settings>Attachment folder. The example for attachment folder path for Linux/Unix systems can be: /usr/sap/gls/attachments. b. It is important to take the backup of the LF_UM_DB_Config.properties and LF_Config.properties files before we start the deployment process. Please follow below steps. Take the backup of the LF_UM_DB_Config.properties and LF_Config.properties files for which the path is mentioned below. The example property file path for Linux/Unix systems can be /usr/sap/gls/j07/j2ee/cluster/apps/glt.com/laserfocusbuild/servlet_jsp/gl t.com~laserfocusapp/root/web-inf/classes Below are the changes done in the property file because of which it is important to take the backup of the property file. LF_Config.properties: LF.DOMAIN.NAME=glt.com~laserfocusapp LF.CENTRAL.LOG.PATH=logs LF.NWA.VERSION=7.31 LF.TABLE.EXISTS=GLT_LF_QZ_JOB_DETAILS,GLT_LF_QZ_JOB_LISTEN ERS,GLT_LF_QZ_TRIGGERS,GLT_LF_QZ_SIMPLE_TRIGGERS,GLT_LF_ QZ_CRON_TRIGGERS,GLT_LF_QZ_BLOB_TRIGGERS,GLT_LF_QZ_TRIG GER_LISTENERS,GLT_LF_QZ_CALENDARS,GLT_LF_QZ_PAUSED_TRI GGER_GRPS,GLT_LF_QZ_FIRED_TRIGGERS,GLT_LF_QZ_SCHEDULER_ STATE,GLT_LF_QZ_LOCKS LF.JOB.TYPE=MITI_CONTROL=User Mitigation,UM_FM_USER_RISK_ANALYSIS=User Risk Analysis,Reminder_Email=Reminder Email,FI_DASHBOARD=Financial Dashboard,FILE_TABLE_JOB=ITK File Job,Escalation_Email=Escalation Email,RISK_CONFIG_XL_VALIDATION=Import Export - Validation,RISK_CONFIG_XL_IMPORT=Import Export Import, IMPORT_CC_JOB=IMPORT CC JOB. If Build is being deployed on multi node instance then value for below properties should be set to TRUE. Default is set for Single Node(FALSE). o QZ_REQUEST_RECOVERY_IMMI=FALSE o QZ_REQUEST_RECOVERY_DAILY=FALSE c. If required, take the backup of the log folder before we start the deployment process. Please follow below steps. The example for log folder path on the Linux/Unix systems is: /usr/sap/gls/j07/j2ee/cluster/apps/glt.com/laserfocusbuild/servlet_jsp/gl t.com~laserfocusapp/root/logs
2. Place the build at /usr/sap/trans/eps/in. 3. Launch the Java Support Manager (JSPM). If any other deployment tool (ex. SDM, SUM) will be used then refer installation guide. 4. The SAP NetWeaver screen opens. 5. Enter the administrator credentials in the User Name and Password text box. 6. Click on the Log On button. 7. Under the Select a package type to apply, choose the option as Single Support Packages (Advanced User Only). 8. Click on the Next button. 9. The as Single Support Packages (Advanced User Only) > Specific Queue screen opens. 10. Select as Single Support Packages (Advanced User Only) to deploy and click on Next. The as Single Support Packages (Advanced User Only) > Check Queue screen opens. 11. On the as Single Support Packages (Advanced User Only) > Check Queue screen, validate the selected software components. 12. Click on the Start button to deploy the selected new components. 13. The as Single Support Packages (Advanced User Only) > Deploy Queue screen opens. 14. The Single Support Packages (Advanced User Only) > Deploy Queue screen shows the deployment of the selected software components with their details under the column headings Order, Vendor/Name, Old Release. SPLevel.PatchLevel, Target Release.SPLevel. Patch Level, and Status. 15. Upload UME Role File provided in folder /UME Roles to NW JAVA. 16. To apply Business Owner enhancements, run below scripts on NW JAVA database schema where AVM LF tables reside. a. LF3.1SP06_BO_Migrate_1.sql. b. LF3.1SP06_BO_Migrate_2.sql 17. Run below script on NW JAVA database schema where AVM LF tables reside, to set the Risk default values for Mitigation configuration. This script is required for Export/Import Utility. It also helps to avoid un-necessary risk versioning. LF3.1SP06_UserMitigation_SetRiskDefaultValues_Configuration.sql 18. Login to AVM-LaserFocus (ex. http://<host name>:<port number>/glt.com~laserfocusapp)/ 19. Attachment Restore:- Please specify the attachment folder from User Mitigation>Configuration>Settings>Attachment folder path. Please restore the attachment back in the above mentioned folder path. The backup was done as part of step 1.a. Note: If local JDBC connector is not already configured, it is mandatory to create JDBC connector pointing to NW JAVA database schema where AVM- LaserFocus is deployed. Restart the application after connector is created.
20. Import Delta Master xml MasterXML_Delta_SP06.xml located in Folder/Metadata through Configuration> Settings> Global Settings> Master data file. Enhancements The list of enhancements in this build is as follows: 1. Go to Configuration tab> Settings> Global Settings> Risk Rule Data. Under the Risk Rule Data, select appropriate value from options IMMEDIATELY, ONCE, DAILY, WEEKLY, and MONTHLY. Click Save. Based on selected frequency is scheduled. Click on Stop to delete selection. The screen displays message as, Job deleted successfully. Figure 1.2: Global Settings- Risk Rule Data Note: ensure to create a System before importing the risk rule data. Master Id data pulled for SAP System is imported through risk rule data. 2. On the Maintain User screen, a new column is added. To view the column, go to Configuration tab> Business Owner Settings> Business Owner. On the Manage Business Owner > Search screen, select appropriate user and click on Maintain User. On Maintain User > Open screen, click on Add button. The Maintain User screen displays new column as Parameter Value. Figure 1.3: Maintain User
3. In AVM-LaserFocus, the administrator can view multi node/single node application logs, status of the system database and application. To view the logs go to Configuration tab>logs Monitor>Application Logs. On the Application Logs > View screen, click on the Node Name link to view details of logs. Figure 1.4: Application Log> View 4. Click the Name link. The View Logs>Log Name screen opens displays details as shown in the following screenshot. Figure 1.5: View Logs 5. The IMPORT ADAPTER DATA FOR USER MITIGATION settings is removed from User Mitigation tab> Configuration> Settings screen. The purpose of importing adapter data is to provide the information of the control programs and their respective input and output parameter used for mitigation process. This functionality is now handled through Export Import Risk feature. For more information on this refer, LaserFocus_User_Guide_v3.1SP06.pdf- section 14.7 Export Import Risk. 6. Under User Mitigation tab>configuration>settings- a new link is added as Configure Mitigation Exceptions Status. To access the feature go to User Mitigation tab> Configuration>Settings- Configure Mitigation Exception Status. Appropriate status from the options OPEN, IN-PROCESS, CLOSED, CLOSED WITH ISSUES.
Figure 1.6: Configure Mitigation Exceptions Status 7. Export Import Risk displays completed risks whose function program mapping is completed and function is completed. To complete function program mapping, system mapping is not mandatory. Finish button is provided for this purpose on the User Mitigation tab> Risk Configuration> Function Program Mapping> Map Program> Configure Program screen. Figure 1.7: Configure Mitigation Exceptions Status 8. Export Import Risk functionality is changed. To know more about newly changes functionality in detail refer, LaserFocus_User_Guide_v3.1SP06.pdf- section 14.7 Export Import Risk. Figure 1.8: Export Import Risk
9. On the User Mitigation> Reports> User Transaction page you can edit comment, delete comment and delete attachment. You can edit/delete comments, only when Mitigation Exceptions Status is configured under User Mitigation tab> Configuration> Settings- Configure Mitigation Exceptions Status. For more information on this, refer section LaserFocus_User_Guide_v3.1SP06.pdf- section 14.1.12 CONFIGURE MITIGATION EXCEPTIONS STATUS. 10. A new feature Job Manger is added. It gives details of scheduled jobs. To know more about Job Manger, refer LaserFocus_User_Guide_v3.1SP06.pdf- chapter 16 Job Manger. Figure 1.9: Job Manger > Job Details Fixed Issues The lists of fixes in this build are as follows: 1. All the jobs in AVM-LaserFocus scheduled on/after 55 mins through 59 mins will have an offset of 5 mins. Example: Job scheduled at 9.56 will executed at 10.01 min. 2. The issue related to data inconsistency in summary reports due to multi tab has been fixed. 3. The conflict related to Business Owner- Custom Group User Mapping has been resolved. 4. On the Risk > Configure Input Parameter Mapping screen parameters limit has been increased up to 50. 5. Risk Execution status is marked as COMPLETE instead of FAILED when no data is fetched from target system over JDBC connection. Mandatory Guidelines 1. A new Control version has be created if there are fundamental changes to risk structure ex. addition or deletion of input / output parameters, change in sequence of input / output parameters, changes to risk composite key, changes to Risk joining condition.
2. For minor control configuration changes ex. Changes to output field text, there is no need to generate new Control version. 3. Before importing risk / function / program configuration major changes (where new Control version is generated), existing Control execution job should be stopped. A new Control monitoring job has to be scheduled once configuration changes are imported. 4. There is no need to cancel existing Control schedule if configuration changes are minor (ex. Output field Text changes). 5. Removal of an output field from Risk which is part of default view set by administrator or individual user requires them to also redefine their default view to be able to see the control output. This should be taken care in either UI modification or import of new risk configuration. 6. Ensure to have application, connector and system created / available in the target system before importing xls file through export / import utility. 7. Once new risk is imported in target system or manually created ensure to maintain Function Program mapping to connect systems to Functions / Programs. 8. Once risk configuration is imported in target system, ensure to generate the Join query for each modified risk manually before scheduling the control by clicking Finish button on Create Join page of risk configuration. 9. All validation errors need to be resolved before being able to import the configuration in target system. 10. In case of cluster environment, it is necessary to restart application server if any connector details are updated /modified. Related Documents 1. SAP_ RM_AVM_Installation_Guide_v1.0.pdf for more information on AVM- RTA DS installation and other details, refer section 2.4 and Chapter 6, 7, 8 and section 9.3 2. SAP_RM_AVM_Configuration_Guide_v1.0.pdf- for more information on AVM- LF configuration, refer: section 2.4 and Chapter 5. 3. SAP_RM_AVM_User_Guide_v1.0.pdf- for more information on how to perform various tasks in AVM- LaserFocus, refer Chapter 22 to 37 and section 38.3 4. SAP_RM_AVM_Base_Add-On_Installation_Guide_for ECC_GRC_v1.0.pdf- This guide provides step by step instruction on deployment of RM AVM- Base Add-On for ECC and GRC. 5. SAP_RM AVM_LaserFocus_GRC_Add- On_Support_Package_Installation_Guide_v1.0.pdf
Revision History Document Title: SAP_RM_AVM_ReadMe_v1.0.pdf Date Created: 28 June 2015 =========================================================== Copyright 2004-2015 Greenlight Technologies, Inc. All Rights Reserved. ===========================================================