Compliance Frameworks
Unified. Simplified.
A free, open directory of cybersecurity, privacy, and regulatory frameworks. Explore domains, controls, requirements, and how they map together — all in one place.
Frameworks → Unified Controls → One View
UCL is a free knowledge base that shows how different compliance frameworks connect through common controls.
Explore GRC Domains
Browse unified controls organized by governance, risk, and compliance domains.
Key UCL Controls
Each unified control maps to requirements from multiple frameworks.
Information Security Governance
Establish, govern, operate, monitor, and continually improve an enterprise information security program that manage...
Policy Management
Define, maintain, and manage the lifecycle of security, privacy, and compliance policies, standards, and procedures...
Risk Management Framework
Establish and maintain a framework for identifying, assessing, treating, and monitoring information security and pr...
Compliance Program Management
Establish and maintain a program to identify, manage, and monitor adherence to all applicable laws, regulations, an...
Regulatory Change Governance & Oversight
Establish clear accountability and governance for identifying, reviewing, assessing, approving, and implementing re...
Identity & Account Lifecycle Management
Manage the entire lifecycle of digital identities, including creation, modification, and deactivation.
Asset Inventory Management
Establish, maintain, and govern a comprehensive inventory of all technology assets, including hardware, software, c...
Data Protection & Privacy Strategy
Establish, implement, and maintain an enterprise data protection and privacy strategy to govern the secure and comp...
Cryptographic Governance
Establish and maintain an enterprise cryptographic governance framework defining the use, management, and oversight...
Secure Network Architecture
Establish and maintain a secure network architecture incorporating defense-in-depth, Zero Trust principles, secure...
Endpoint Protection
Establish and maintain endpoint protection capabilities to prevent, detect, and mitigate malware and other endpoint...
Cloud Security Governance
Establish and maintain an enterprise cloud security governance framework, strategy, policies, standards, and oversi...
Secure Configuration Baseline
Establish, maintain, and govern secure configuration baselines for systems, applications, databases, network device...
Vulnerability Management Strategy
Establish and maintain an enterprise vulnerability management strategy governing the identification, assessment, pr...
Application Security Program
Establish and maintain an enterprise application security program governing the secure development, acquisition, de...
Security Architecture Framework
Establish and maintain an enterprise security architecture framework including architecture strategy, reference arc...
Change & Release Management
Establish and maintain controlled processes for requesting, assessing, approving, testing, implementing, and review...
Security Operations Center (SOC) Management
Establish and maintain a Security Operations Center (SOC) responsible for continuous security monitoring, operation...
Threat Intelligence Management
Establish and maintain processes to collect, analyze, correlate, validate, operationalize, and share cyber threat i...
Incident Response Program
Establish and maintain an enterprise incident response program, including governance, policies, plans, roles, respo...
Business Continuity & Disaster Recovery (BCDR) Program
Establish and maintain an enterprise Business Continuity and Disaster Recovery (BCDR) program including governance,...
Operational Resilience Program
Establish and maintain an enterprise operational resilience program including governance, strategy, resilience obje...
Physical Security & Facility Access Management
Establish and maintain physical security controls to protect facilities, personnel, information assets, and critica...
Third-Party Risk Management Program
Establish and maintain an enterprise Third-Party Risk Management (TPRM) program to govern the identification, asses...
Personnel Screening & Verification
Establish and maintain processes for pre-employment screening, background verification, identity validation, and pe...
Security Awareness Program
Establish and maintain an enterprise security awareness program to educate, communicate, and reinforce information...
AI Governance & Oversight
Establish and maintain an enterprise governance framework for the responsible development, acquisition, deployment,...
Audit & Assurance Program
Establish and maintain an enterprise audit and assurance program to govern internal audits, external assessments, c...
Exception Management Program
Establish and maintain an enterprise exception management program to govern the identification, evaluation, approva...
All Frameworks in UCL
Explore frameworks by category, region, or industry. Click any framework to view details.
Domains and Associated Controls
Browse UCL governance domains and their associated unified controls.
| GOVERNANCE DOMAIN | SCOPE & OVERVIEW | ASSOCIATED UNIFIED CONTROLS | ACTION |
|---|---|---|---|
| Establishes the foundational structures, processes, and accountabilities for information security and privacy oversight, defining how security decisions are made and how the security program is directed, monitored, and continuously improved. |
GOV-001
Information Security Governance
(+7 more)
|
||
| Establishes the lifecycle management of security and compliance policies, standards, procedures, and related documentation across the enterprise, ensuring consistent development, approval, communication, and maintenance. |
POL-001
Policy Management
(+3 more)
|
||
| Establishes the processes for identifying, assessing, prioritizing, treating, and monitoring information security and privacy risks across the enterprise, ensuring risks are managed within defined appetite and tolerance levels. |
RSK-001
Risk Management Framework
(+8 more)
|
||
| Establishes the processes for identifying, managing, and demonstrating compliance with legal, regulatory, and contractual obligations, ensuring the organization meets all applicable requirements. |
CMP-001
Compliance Program Management
(+6 more)
|
||
| Establishes the processes for identifying, assessing, and responding to changes in legal, regulatory, and contractual requirements, ensuring ongoing compliance with evolving obligations. |
REG-001
Regulatory Change Governance & Oversight
(+5 more)
|
||
| Establishes the processes for managing digital identities, controlling access to organizational resources, and ensuring that the right individuals and entities have appropriate access to systems, applications, and data. |
IAM-001
Identity & Account Lifecycle Management
(+7 more)
|
||
| Establishes the processes for identifying, classifying, and managing organizational assets, ensuring visibility into what assets exist and their security requirements. |
AST-001
Asset Inventory Management
(+7 more)
|
||
| Establishes the processes for protecting personal and sensitive data throughout its lifecycle, ensuring privacy compliance and data security across all processing activities. |
DAT-001
Data Protection & Privacy Strategy
(+15 more)
|
||
| Establishes the processes for managing cryptographic controls, encryption technologies, and cryptographic keys to protect data at rest, in transit, and in use. |
CRY-001
Cryptographic Governance
(+4 more)
|
||
| Establishes the processes for securing network infrastructure, controlling network communications, and protecting against network-based threats. |
NET-001
Secure Network Architecture
(+7 more)
|
||
| Establishes the processes for securing endpoint devices including desktops, laptops, servers, and mobile devices against security threats. |
END-001
Endpoint Protection
(+5 more)
|
||
| Establishes the processes for securing cloud environments, services, and data across public, private, and hybrid cloud deployments. |
CLD-001
Cloud Security Governance
(+9 more)
|
||
| Establishes the processes for defining, maintaining, and enforcing secure configurations across systems, applications, and infrastructure. |
CFG-001
Secure Configuration Baseline
(+5 more)
|
||
| Establishes the processes for identifying, assessing, prioritizing, and remediating vulnerabilities across organizational systems and applications. |
VUL-001
Vulnerability Management Strategy
(+7 more)
|
||
| Establishes the processes for securing applications throughout their lifecycle, from design through development, testing, and deployment. |
APP-001
Application Security Program
(+11 more)
|
||
| Establishes the processes for designing, governing, and implementing security architectures and principles across the enterprise. |
ARC-001
Security Architecture Framework
(+5 more)
|
||
| Establishes the processes for managing IT operations, services, and infrastructure security, ensuring operational stability and security. |
OPS-001
Change & Release Management
(+6 more)
|
||
| Establishes the processes for operating security operations centers, detecting threats, and automating security responses. |
SOC-001
Security Operations Center (SOC) Management
(+3 more)
|
||
| Establishes the processes for collecting, analyzing, and using threat intelligence to understand and manage security threats. |
THR-001
Threat Intelligence Management
(+3 more)
|
||
| Establishes the processes for preparing for, detecting, responding to, and recovering from security incidents. |
INC-001
Incident Response Program
(+6 more)
|
||
| Establishes the processes for ensuring business continuity and IT disaster recovery capabilities, enabling resilience to disruptions. |
BCM-001
Business Continuity & Disaster Recovery (BCDR) Program
(+5 more)
|
||
| Establishes the processes for ensuring the organization can withstand, adapt to, and recover from operational disruptions across business services and dependencies. |
OPR-001
Operational Resilience Program
(+5 more)
|
||
| Establishes the processes for securing physical facilities, protecting personnel, and managing environmental threats to critical infrastructure. |
PHY-001
Physical Security & Facility Access Management
(+5 more)
|
||
| Establishes the processes for managing security and compliance risks associated with third-party vendors, suppliers, and the extended supply chain. |
TPR-001
Third-Party Risk Management Program
(+5 more)
|
||
| Establishes the processes for securing the workforce through screening, obligations, lifecycle management, and ethical standards. |
HRS-001
Personnel Screening & Verification
(+3 more)
|
||
| Establishes the processes for developing, delivering, and measuring security awareness and training programs across the workforce. |
SAT-001
Security Awareness Program
(+3 more)
|
||
| Establishes the processes for governing, securing, and managing artificial intelligence systems and AI-related risks across the enterprise. |
AIG-001
AI Governance & Oversight
(+5 more)
|
||
| Establishes the processes for internal and external audit, control assurance, and compliance validation to provide confidence in security controls. |
AUD-001
Audit & Assurance Program
(+6 more)
|
||
| Establishes the processes for managing exceptions to security policies, standards, and control requirements in a controlled and governed manner. |
EXC-001
Exception Management Program
(+1 more)
|
Each governance domain categorizes unified security controls to streamline framework implementation and audit readiness.
Frequently Asked Questions
Quick answers to common questions about UCL and framework mappings.
Related Articles
Deep dives into compliance frameworks, domains, and unified control management.
RBI Guidelines For Concurrent Audit Of Banks (2026)
Complete guide to RBI concurrent audit guidelines for banks covering scope, empanelment, compliance, ITGC, continuous monitoring, and audit readiness.
Read More →RBI Audit For Banks: Complete Cybersecurity, ITGC & Compliance Guide
Learn how RBI audits work for banks, including cybersecurity audits, audit checklists, evidence requirements, observations, and operational audit readiness.
Read More →RBI Cyber Security Framework For Banks: Complete Compliance & Audit Guide
Learn RBI Cyber Security Framework requirements, security controls, audit expectations, compliance checklists, and how banks automate compliance.
Read More →Explore UCL — Free & Open
No sign-up. No paywall. Just a clean reference for compliance professionals.
Browse All Frameworks 20+ frameworks · 29 domains · 196 unified controls · 1,944 requirements