The IT Unified Compliance Framework

Download the Unified Compliance Framework Publication Complete Set

The Unified Compliance Framework (UCF) is the first and largest independent initiative to map IT controls across international regulations, standards, and best practices. The UCF accomplishes its goal by harmonizing terms and controls against the backdrop of a master hierarchical list. In simple terms this means that the complex rules, standards, and policies you must follow are presented in a simple spreadsheet matrix format with in-depth links for you to drill down for as much information as you need.

Some of the compliance frameworks and standards that many organizations have to grapple with include:

US's Sarbanes-Oxley Act
US's Health Information Portability and Accounting Act (HIPAA)
Control Objectives for Information and Related Technology (COBIT)
Gramm-Leach-Bliley Act (GLBA)
ISO 27001
ISO 27002
Business Continuity Institute (BCI),
Standards from the British Standards Institute (BSI),
Information Security Forum (ISF),
PCI DSS

See the full list of laws, regulations, frameworks and standards tracked by the UCF in an extract from the eBook.

Say What You Do: Building a Framework of IT Controls, Policies, Standards, & Procedures V1 enables you to move to a single regulatory compliance information security framework across the entire organisation, rather than having many seperate, competing or conflicting frameworks; the UCF helps establish a common set of methods, procedures and controls across many of the major IT security frameworks, regulatory regimes & standards, including SOX, HIPAA, GLBA, COBIT, ISO27001, etc.

The Language of Compliance (which underpins the UFC) explains and demystifies over 3,500 terms, acronyms and abbreviations from the compliance world.

Sensibly, you might order copies of both publications and use them to start bring order and coherence to your multiple compliance initiatives.

In short, by focusing on the commonalities between standards and guidelines, you can comply with a given rule once, while attesting to it for many different regulations