According to the SAP Press blog3, you need to specify the control ID and the risk owner when defining a mitigating control. Control ID is a unique identifier for the mitigating control, and risk owner is the person who is responsible for monitoring and reporting on the mitigating control.

According to the SAP Help Portal, you can generate two types of rules for MSMP Process ID SAP_GRAC_ACCESS_REQUEST that utilize an expression of type decision table: BRFplus rule and BRFplus flat rule. A BRFplus rule is a rule that uses the BRFplus framework to define complex business logic using expressions, functions, or data objects. A BRFplus flat rule is a rule that uses a simplified structure to define simple business logic using conditions and actions.

According to the SAP wiki, you need to set the 1064 Function Maintenance parameter to YES to enable the approval process for updates to a function that is contained within a delivered SAP risk. This parameter controls whether function maintenance requires approval or not.

According to the SAP Help Portal1, two of the methods that can be used to notify a controller of a new EAM session log are: Email and Workflow (D). These methods can be configured in the Customizing activities for Emergency Access Management. Email notifications can be enabled by setting parameter 4009 to Yes and customizing the notification messages and text. Workflow notifications can be enabled by configuring the Agent ID GRAC_SPM_CNTL_AGENT and assigning it to the relevant workflow paths and stages. Therefore, C and D are the correct answers. A and B are not valid methods for notifying a controller of a new EAM session log, as they are related to other scenarios, such as Support Message (A) and Log Display (B). Reference: 1 https://help.sap.com/doc/e2ccae7ee6354b169cf845cd665e07fe/1.0%202016-07/en-US/frameset.htm?frameset.htm

According to the SAP Blogs2, Rule Kind is a classification of rules that are used in MSMP Workflow configuration. There are two types of Rule Kind: Function Module and Decision Table. Function Module rules are custom ABAP code that can be used for complex logic or integration with external systems. Decision Table rules are graphical tables that can be created and maintained using BRFplus application. Notification Variable and Agent are not valid Rule Kinds, but they are types of Agent Rules that define the recipients of notifications or approvals during the workflow. Reference: 2 https://blogs.sap.com/2022/09/21/msmp-workflow-configuration-grc-access-control-10.0/