Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.
  • Madrid
  • London
  • Kingston
  • Jakarta
  • Istanbul
  • Helsinki
  • Geneva
  • Store

Update a UCF document manually - Legacy

Log in to subscribe to topics and get notified when content changes.

Update a UCF document manually - Legacy

By default, GRC is configured to require manual update of the UCF documents it uses.

About this task

Resolve any pending approval requests for GRC updates before attempting to download new UCF documents. The system blocks the download until all requests are either approved or rejected.


  1. Navigate to GRC > Administration > Import UCF Content

    The UCF Authority Documents screen displays the current documents.

  2. Click Check UCF Status.

    The download screen appears, showing the results of the previous download, including the UCF file name. The system checks the UCF document version and displays a banner in the download screen advising if your version is current or can be updated.

    Notice of new UCF version
  3. To download a new version, click Start.

    If you have pending approval requests for GRC updates, the system blocks the download.

  4. Resolve any pending requests before proceeding

    The download screen tracks the progress of the update. GRC downloads the latest UCF archive and unpacks it. The system then deletes the contents of the staging tables and reloads them with the latest data. There is no versioning used in these tables. During this operation, the system compares the incoming data with the current data in GRC to determine if anything has changed. When the update is finished, the download screen shows the results of the comparison.

    Note: If the internet connection is lost for any reason, a message appears in the bottom of the download screen advising you of this exception. The system attempts to reconnect to the UCF download site and removes the message when communication is restored.
    UCF update completion screen
  5. Look at the value in the GRC Import Status field in the cards for the documents you use to see if updates are available.

    Possible status values are:

    • Up to date: Documents you have imported that are currently up to date in your system. There is no update available from UCF in the latest version. The check box for up to date items is disabled.
    • Not updated: Available documents that you have not imported into GRC.
    • Update available: Documents you have imported previously for which updates are available.
  6. If the system indicates that an update is available, click the arrows on the card to view the difference between your current GRC data and the latest UCF version of that data.
    UCF notification of available update

    A window appears, showing specific differences between the two versions. These conditions can occur if:

    • The UCF column is empty, but the GRC column contains an entry. In this case, the entity is no longer provided by UCF. The ServiceNow system responds by deactivating the entity in GRC, making it unavailable for any control test definitions that previously used it.
    • The GRC column is empty, and the UCF column contains an entry. In this case, the download file contains a new entity that is added to GRC during the update.
    • Both the UCF column and the GRC column contain entries. In this case, the entity must be updated from UCF to GRC.
    Changes between UCF versions
  7. To update a new version of a document, select the check box on the card and click Import into GRC.

    If approval is required, the system sends your request to users with the grc_executive_approver role, who can either approve or deny the request. The system moves approved content to the appropriate GRC tables. If earlier versions of the document exist in the database, GRC increments the Version field on the new record and attaches it to the control test definitions, policies, and risks that use it.

  8. View all previous versions of a source in the Other versions related list for records in the following tables:
    • Authoritative Source [grc_authoritative_source]
    • Authoritative Source Content [grc_authoritative_src_content]
    • Control [grc_control]