--- sourceDocument: Zurich Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # integrate with UCF Common Controls Hub # Integrate with UCF Common Controls Hub to manage compliance frameworks {#ariaid-title1} Release version: Zurich Updated July 31, 2025 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Integrate with UCF Common Controls Hub to manage compliance frameworks This integration enables compliance administrators using ServiceNow Governance, Risk, and Compliance (GRC) to download and manage compliance content from the Unified Compliance Framework (UCF) Common Controls Hub (CCH). The content includes authority documents, citations, controls, and control objectives, which serve as authoritative references for compliance frameworks. The integration facilitates keeping compliance data current by updating documents at predefined intervals. Show full answer Show less To use this capability, an active UCF Common Controls Hub subscription with API access is required, which is available for purchase through the ServiceNow Store or directly from UCF. Note that free access to UCF content with GRC licenses ended in 2018, so a paid subscription is mandatory. ## Key Features * **Account Setup and Integration:** Customers must create a UCF CCH account with API access and initiate integration via a Now Support Case. Compliance UCF activation is also needed. * **Shared Lists:** Authority documents must be organized into shared lists in UCF CCH for import. Compliance managers download these shared lists to import content into ServiceNow. * **Importing Authority Documents:** * Single shared list import supports up to 100 authority documents. * For over 100 documents, multiple shared lists can be created and imported. Documents should be grouped logically to avoid dependencies between lists. * A system property controls validation of imported documents; disabling validation allows import of multiple shared lists but requires manual verification of deprecated documents. * **Read-Only Data:** Imported authority documents, citations, and control objectives are read-only within ServiceNow and must not be customized to maintain data integrity. * **Terminology Alignment:** The integration maps UCF terminology to ServiceNow GRC terminology for ease of use: * UCF Authority Document = GRC Authority Document * UCF Citation = GRC Citation * UCF Control = GRC Control Objective ## Practical Guidance * Ensure all previously imported authority documents are included in any shared list before reimporting to prevent inconsistencies and errors. * Update all authority documents regularly when adding or changing content to keep the compliance framework synchronized. * Manually review deprecated documents and citation-control objective mappings if importing multiple shared lists with validation disabled; the system sends email notifications to assist with this process. Compliance administrators can download content from Network Frontiers Unified Compliance Framework (UCF) to use as GRC authority documents, citations, controls, and control objectives. The documents can be updated on pre-defined intervals. You must have a UCF Common Controls Hub account to create shared lists and import them into the ServiceNow® instance. If your organization wants to use UCF Common Controls Hub as the source for your controls library, you can purchase a subscription from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) or see [Common Controls Hub](https://commoncontrolshub.com/pricing/). For more information, see [Unified Compliance Framework](https://www.unifiedcompliance.com/company/). Note: The previous arrangement for free access to UCF content inclusive of your GRC license ended November 30, 2018. All customers must purchase a subscription from Unified Compliance directly. Warning: All data imported from UCF Authority Documents is read-only and must be protected. Do not customize the authority documents, citations, or control objectives on any UCF fields transformed into GRC tables. 1. Sign up for a [UCF CCH](https://commoncontrolshub.com/pricing/) account and customize your basic subscription to include API Access. 2. [Activate Compliance UCF](https://www.servicenow.com/docs/iKtllQuK_HyVS74WZTLrAA "The GRC: Compliance UCF (com.sn_comp_ucf) plugin is available as a separate subscription."). 3. [Create a Now Support Case for UCF-CCH account integration information](https://www.servicenow.com/docs/GklMY0edrT5~3LzvobxT6w "After establishing your UCF CCH account, use the Now Support Service Portal to initiate the account integration process."). 4. [Configure the UCF integration using the UCF Common Controls Hub](https://www.servicenow.com/docs/Wv07ZMM0av2hLpiZTcnVug "Compliance administrators can download content from Network Frontiers Unified Compliance Framework (UCF) to use as GRC authority documents, citations, controls, and control objectives."). 5. [Download a UCF shared list](https://www.servicenow.com/docs/Un5eGtDwVpaYBJfadruBsg "In order for compliance managers to download UCF authority documents from the UCF CCH, the list must be marked as Shared. When updating Authority Documents or adding new ones, you must update all your authority documents to ensure that the common controls framework remains in sync with the authority documents you are using."). {#c_UCF__ol_asr_5hy_m1b} ## Import authority document using single shared list {#c_UCF__section_upy_5ny_fcb} Every authority document already imported into the ServiceNow® instance must be in any shared list you wish to import from the UCF CCH. This prevents inconsistencies between what is in the UCF CCH (which may have changed) and what you've already imported. An error is shown if any item in the shared list is not included for reimport. ## Import authority documents using multiple shared lists {#c_UCF__section_ihz_pjm_1tb} If you need to import more than 100 authority documents then you must import them into multiple shared lists, as there is a limitation that a shared list can contain only 100 authority documents. You can create multiple shared list (SL), for example SL1 to import 100 authority documents and SL2 for the rest of the authority documents. Group similar authority documents as one group when you import the authority documents into multiple shared list, so that there is no dependency of the documents between the multiple shared list. To support multiple shared list, the system property sn_comp_ucf.deactivate_deprecated_docs that is by default true, must be set to false. * If the system property is set to true, then the existing validation is done to check if the authority documents imported are already imported in the ServiceNow instance. * If the system property is set to false, then the imported authority documents are not validated at all. {#c_UCF__ul_f32_25z_1tb} Set the property as false and import the UCF content in multiple shared list. If the authority documents, citations, and control objectives that are imported in the shared list are deprecated, then such documents will not be deactivated in the ServiceNow instance. Instead, the user must manually validate the documents and the links between the citation and control objectives. An email is sent with the links to the mapping between the citation and control objectives. ## UCF and GRC terminology differences Authority documents in the UCF content are organized and mapped to their proper citations, which in turn are mapped to a common set of controls. The terminology between UCF and the GRC applications differs slightly as explained in the following table. {#c_UCF__table_hth_hjb_mw__entry__2} | UCF | GRC application | |-|-| | Authority Document | Authority Document | | Citation | Citation | | Control | Control Objective | [Table 1. Terminology differences] {#c_UCF__table_hth_hjb_mw} * **[Create a Now Support Case for UCF-CCH account integration information](https://www.servicenow.com/docs/GklMY0edrT5~3LzvobxT6w)** After establishing your UCF CCH account, use the Now Support Service Portal to initiate the account integration process. * **[Download a UCF shared list](https://www.servicenow.com/docs/Un5eGtDwVpaYBJfadruBsg)** In order for compliance managers to download UCF authority documents from the UCF CCH, the list must be marked as Shared. When updating Authority Documents or adding new ones, you must update all your authority documents to ensure that the common controls framework remains in sync with the authority documents you are using.