By default, GRC is configured to require manual update of the UCF documents it
Resolve any pending approval requests for GRC updates before attempting to download
new UCF documents. The system blocks the download until all requests are either
approved or rejected.
The UCF Authority Documents screen displays the current documents.
Click Check UCF Status.
The download screen appears, showing the results of the previous download,
including the UCF file name. The system checks the UCF document version and
displays a banner in the download screen advising if your version is current
or can be updated.
To download a new version, click Start.
If you have pending approval requests for GRC updates, the system blocks the
Resolve any pending requests before proceeding
The download screen tracks the progress of the update. GRC downloads the
latest UCF archive and unpacks it. The system then deletes the contents of
the staging tables and reloads them with the latest data. There is no
versioning used in these tables. During this operation, the system compares
the incoming data with the current data in GRC to determine if anything has
changed. When the update is finished, the download screen shows the results
of the comparison.
Note: If the internet connection is lost for any reason, a message appears
in the bottom of the download screen advising you of this exception. The
system attempts to reconnect to the UCF download site and removes the
message when communication is restored.
Look at the value in the GRC Import Status field in the
cards for the documents you use to see if updates are available.
Possible status values are:
- Up to date: Documents you have imported that
are currently up to date in your system. There is no update
available from UCF in the latest version. The check box for up to
date items is disabled.
- Not updated: Available documents that you
have not imported into GRC.
- Update available: Documents you have imported
previously for which updates are available.
If the system indicates that an update is available, click the arrows on the
card to view the difference between your current GRC data and the latest UCF
version of that data.
A window appears, showing specific differences between the two versions.
These conditions can occur if:
- The UCF column is empty, but the
GRC column contains an entry. In this
case, the entity is no longer provided by UCF. The ServiceNow
system responds by deactivating the entity in GRC, making it
unavailable for any control test definitions that previously used
- The GRC column is empty, and the
UCF column contains an entry. In this
case, the download file contains a new entity that is added to GRC
during the update.
- Both the UCF column and the
GRC column contain entries. In this case,
the entity must be updated from UCF to GRC.
To update a new version of a document, select the check box on the card and
click Import into GRC.
If approval is required, the system sends your request to users with the
grc_executive_approver role, who can either approve or deny the request. The
system moves approved content to the appropriate GRC tables. If earlier
versions of the document exist in the database, GRC increments the
Version field on the new record and attaches it
to the control test definitions, policies, and risks that use it.
View all previous versions of a source in the Other
versions related list for records in the following tables:
- Authoritative Source [grc_authoritative_source]
- Authoritative Source Content [grc_authoritative_src_content]
- Control [grc_control]