Question about GRC BRM on N+1 Landscape

[jeron_sanders2]

Hi All,

Is it currently possible with BRM to have multiple "Development" environments for roles? We have a sandbox that we create prototyping roles, a project development system where roles are created and transported, and a production support development system where roles are created / changed and transported, then retrofit back to the project development landscape.

We would like to be able to create roles in any of these three environments, but from what I am seeing so far, it does not seem to be possible. Does anyone have any suggestions on how to set up the system to where this would be possible?

[Former Member]

Hi Jeron,

Could you try the 2 development systems in option, 'assign default connector to connector group', as 'Authorization Maintenance', in a single and diff. logical group.

Regards

plaban

[Former Member]

Hello Plaban,

can you elaborate.

Rajesh    

[jeron_sanders2]

If I were to have multiple connector groups, would I have to maintain two separate roles with the same name in each connector group in GRC? I understand that the backend system would only have the single role, I'm just curious as to how it would be maintained.

This is what I am imagining:

S1 - Single system in it's own connector group for prototyping role changes in sandbox.

S1, D1 (Default Maintenance), Q1, PP1, D2, Q2, P1 - All systems in the landscape with DEV as the maintenance.

D2(Default Maintenance), Q2, P1 -  Production maintenance landscape role changes starting in our production support development system. Roles and changes would be retrofit to D1 in main connector group.

So I would have 3 connector groups in this scenario, but would I need to be running multiple sync jobs in D2, Q2, P1, and S1 in order to make sure that the roles are synced into both connector groups?

[Former Member]

If you are planning to have same role names but built differently within the individual systems, I would strongly suggest that the specific system is only listed against 1 of the 3 connector groups.

If for example you have S1 listed in 2 different logical groups, I have experienced GRC play havoc with the "Role Exists" data obtained from the role sync. This severely impacts the Business Role concept (if you plan to utilise it).

Are you planning on using the GRC Prod system to build the roles in Development target systems?

[jeron_sanders2]

The plan is to use GRC Production to change the roles in the development systems.

I guess I'm a bit confused by your statement about the "Role Exists" issue because I don't see how it's different than having a non-development system that hasn't had the role transported to it yet.

Even if the prototyping system is kept separate, there is no way to do that with the D2 and D1 systems as everything from the D1 system gets transported through D2 system.

Message was edited by: Jeron Sanders I feel like there has to be other customers using BRM with an N+1 landscape.