Does anybody know in which way it might be possible to lock the SAP Standard GRC Rule Set against updates (SP, Patch etc.)?
Do I have to set a Parameter ID in SPRO? And if yes, which one? Or is there another setting I have to enter?
Thanks for your response in advance!
Standard Rules are delivered by SAP through BC sets. So, initially when you activate BC sets as required by you the standard rules are updated in corresponding tables.
Now when you upgrade your support pack or patches there will not be any impact on your existing configurations and you might not require to re-activate BC sets. Recently SAP release SRM rules and when you want those you can just activate only that corresponding BC set without re-activating the already activated BC sets.
Technically there is no such configuration or Parameter ID as the updates are not auto-pushed or updated during support pack or patches upgrade
You can always take the backup of your rule set and can re-upload if any issue.
You can limit the CHANGE capabiltiy on the GLOBAL (or any other) ruleset via security authorization. In regards to copying the rules, it really is not necessarry, as there will never be any updates to the ruleset in any SP, and when SAP does deliver updates they always need to be manually inserted into your rules, even if you use the delivered.
The BC set is intended to be used by the customer and then to be modified throughout the life of the SAP Access Control solution. If you copy all items into your namespace (Z...), then you will need to 'translate' any subsequent updates when they are released by SAP.
Hope this helps.