The primary nouns and verbs in each sentence are the focus of the mandate. Specifically, the primary verb is the action that must be performed and the primary noun is the thing being acted on.
Secondary nouns and verbs are used to provide additional context, but are not the main focus of the mandate.
Protect the Privacy of children.
Prohibit shared authentication methods such as shared passwords or tokens.
Destroy media when it is no longer needed.We should change these to images with callouts, like in the Mapper. Some people are colorblind.
In the examples above the primary verbs are highlighted in dark blue, the primary nouns in light blue, the secondary nouns in red, and the secondary verbs are in yellow. (The limiting term is in purple. Don't worry, we'll get to those)
In the first example, protect is the primary verb, because that is the action that must be completed. privacy is the primary noun, because that is what needs to be protected. Children is the secondary noun because children are not the subject of the mandate.
In the third example, destroy is the primary verb, media is the primary noun, and no longer needed is the secondary verb phrase because it adds additional context for when the media must be destroyed. Easy, right? Not so fast!

Term Designators, Named Entities, and Element Types

Although at the core we work strictly with nouns, verbs, and their associated phrases, rarely is a term in the dictionary merely considered just a noun or verb. Rather, Terms in the Compliance Dictionary are designated to be named entities (referred to as UCF Elements), which allow the Mapper system to work with The UCF's Natural Language Processing engine that performs entity identification, entity chunking and entity extraction routines. By classifying terms as named entities, the named portion restricts the model to those entities for which the designator can stand for the term. Below are descriptions and examples of the types of named entities that The UCF tracks:

Asset - A service or thing owned by an organization or person that falls under the purview of an Authority Document's controls either because of its value or its configuration properties. (i.e. information technology)
Authority Document - Statutes, regulations, directives, principles, standards, guidelines, best practices, policies, and procedures. (i.e. 45 CFR Part 160 - General Administrative Requirements)
Configurable Item - A part of an asset specifically called out during the audit process. (i.e. minimum password length)
Configuration Setting - A modifiable element within a Configurable Item that can affect performance and system function. (i.e. enabled/disabled)
Data Contents - A field within a record. (i.e. account number)
Group - A division within an organization or a formation of individuals outside an organization, or a generic unnamed organization. (i.e. temporary employee)
Organization - A named organized body of people with a particular purpose, especially a business, society, association, etc. (i.e. Microsoft)
Organizational Function - The high level administrative departments of an organization. (i.e. Human Resources)
Organizational Task - An individual process or task and organization performs. (i.e. background check)
Record Category - A class, grouping, or set of records. (i.e. Internal Operational Audit - Information Technology)
Record Example - An individual record within a Record Category. (i.e. visitor log)
Role - A word or phrase that represents the function an individual, process, organization, etc. is supposed to achieve. (i.e. internal audit manager)
Title - A name that describes someone's position or job. (i.e. Chairman Joint Chiefs of Staff)
Triggering Event - A unique activity within a given process or state that causes an event or situation to happen. (i.e. list is updated)

Limiting Terms

Limiting terms are words that indicate when an action must take place compared with another action. They are typically conjunctions or prepositions, and are linked to monitored events (more on those shortly). A typical mandate containing a limiting term would be 'Refrain from erasing personal data until authorization is received.' In this case the mandate demands that authorization must be received before personal data can be erased. To erase the data prior to authorization would be a compliance violation.

Monitored Events

Monitored events are, as you may have guessed, actions that the organization must monitor and react to. They are created from a combination of limiting terms and Organizational Tasks or Triggering Events, and are identified after tagging has been completed, but before the task is finalized.

Verb Phrase Types

Co-dependent Verb phrases and

Co-dependent verb phrases are groupings of actions that whereby it is assumed that for one action to be performed, the others should as well. For example, in the mandate 'approve and sign the information security policy', 'approve and sign' is the verb phrase. In this case the mandate assumes that if the information security policy is approved, you should sign it, and that you wouldn't sign it if you didn't approve it.

Ordered Logic

Ordered logic verb phrases dictate the order in which actions should take place. For example, in the mandate 'analyze and quantify operational issues' 'analyze and quantify' is the verb phrase. Based on the concept of ordered logic this is one mandate instead of two, as it can be logically assumed that operational issues shouldn't be quantified until after they are analyzed. Although operational issues can be quantified after or even without analyzing them, the mandate requires that you do one before the other.
The difference between co-dependent and ordered logic verb phrases lies in the assumption that with co-dependent phrases you can't or shouldn't do one without the other whereas with ordered logic you can do one without the other, but you should do one before the other.

Dual assignment

For dual assignment verb phrases the assumption is that the mandate instructs the same person to perform all of the actions. For example, in the mandate 'the bookkeeper shall bill and settle all outstanding accounts', billing and settling are two distinct actions, but both should be performed in tandem by the same person. If accounts are billed but not settled, the mandate is not satisfied.

Browser not supported