There are two main versions of the GRC Access Control product:
A. Version 4.0 - This is an ABAP only based version of the GRC products and will require you only to update Access Control 4.0 Support Packs on the ABAP stack.
B. Version 5.X - These versions contain both ABAP and Java (Web based) components. Therefore, when applying support packs, you will need to apply on both ABAP and Java stacks. The packages are different and the application method is also different between Java and ABAP. It is required that you have both the ABAP and Java support pack levels up to date as they are released on the Service Marketplace.
Please note that the support pack level on the ABAP and JAVA side may not be the same however you must have both the latest support pack levels installed. For example, you cannot have your Access Control Java component on the latest 5.X support package, while your ABAP stack is still on an older support pack for 5.X.
Please refer to SAP Note 1086823 if you are unclear if you should install the VIRSA, VIRSANH, or VIRSAHR Real Time Agent (RTA). Please note that the installation is different based on 4.0 or 5.X. It's very important to review Note 1086823 to obtain an understanding of the installation method.
For both 4.0 and 5.X, when installing the ABAP component, you must first install the Base installation via transaction SAINT and all relevant Support Packages via transaction SPAM. You will need to install the Base installation and Support Packages in chronological order as they are not cumulative.
In 5.X versions, when installing the Java Support Packages (VIRCC, VIRAE, VIRFF,VIRRE), you only need to install the latest available Support Pack as the Java component will contain the full product as well as all the fixes provided in previous Support Packs. Therefore, Java support packs are cumulative and don't need to be applied sequentially.