About Unified Compliance Framework
UCF (Unified Compliance Framework) is the largest library of regulatory content available today. It contains:
• Authority Documents
• Citations
• UCF Controls
When you use UCF, the whole compliance project becomes less expensive than if chose to deal with each regulation separately.
Main UCF Concepts
Authority Documents
An Authority Document is a text that falls under any of following categories:
• regulations (rules of law that, if not followed, can result in penalties),
• guidelines,
• standards,
• best practices.
Citations
Citations are references extracted from the original Authority Documents. They are associated to UCF Controls.
Citations are converted to regulation articles or sections in
Hopex (depending on whether the Citation is associated to a Mandated Control or not). For more details, see
Viewing Regulation Articles.
• Citation without any mandate, but containing other Citation becomes a regulation section.
• Citation without any mandate and no children Citation become a regulation article that bears no relevance to the organization.
UCF Controls
Common Controls are the specific steps or actions that must be met to fulfill a compliance mandate stated in a Citation.
Depending on their relations with Citations, different types of UCF controls can be distinguished. For more details, see
Links between UCF concepts.
Links between UCF concepts
Enforcement Level is determined by the association of the Common Control to a Citation within a given Authority Document and not by a specific attribute of the Common Control itself.
Citations are associated to UCF Controls, which can be:
• mandated (in bold)
Only Mandated Controls are mandatory.
Common Controls become mandated when they are applied to at least one Citation from any Authority Document.
A Common Control that becomes mandated has an impact on the Controls it supports and the Controls that, in turn, support it.
• implied (in italics)
Implied Controls are UCF Common Controls which are not mandated but contain Mandated Controls in their support structure.
• Implementation
Controls supporting Controls become ‘Implementation Controls'. They provide details not found in Mandated Controls regarding how to carry out the Mandated Control.
Building a Shared List
A Shared List is a selection of Authority Documents that your organization needs to comply with and that you have chosen and saved in the Common Controls Hub workspace.
Lists can be created for documents related to geographic regions of your organization, specific subject matters ("Cybersecurity" or "Banking and Finance"). Select the Authority Documents you need to comply with. All associated Common Controls are automatically displayed in a harmonized, hierarchical list.
A Shared List becomes a control framework once imported to
Hopex (a set of regulatory frameworks).
Make sure your list only includes the Authority Documents you want to import into Hopex.
Mapping between UCF and Hopex Concepts
UCF | Hopex | Icon in HOPEX |
|---|
Authority Document | Regulatory framework | |
Citation Without Mandated Control Contains other Citations | Regulation section | |
Citation Without Mandated Control | Regulation article | |
Citation Without Mandated Control AND without Children | ("leaf") Regulation article | |
UCF Common Control | Control directive | |
