GRC OS: an AI Operating System for GRC
A ready-to-run Claude Code workspace for running a governance, risk and compliance programme. Clone it, open it in Claude Code, and Claude works as a senior GRC practitioner alongside you. It knows your company and follows a proven method, and it never signs anything off on your behalf.
It's built for two kinds of people:
- GRC practitioners and engineers who want to run programme work as code: versioned, repeatable and auditable.
- "Accidental" owners: the founder, CTO or ops lead who has just been told a customer needs ISO 27001, SOC 2 or Cyber Essentials, and doesn't know where to start.
It covers ISO 27001, SOC 2, Cyber Essentials, GDPR and ISO 42001, using the eleven skills from GRC Skills.
Built by Harry West, founder of GRCMANA. Harry has spent around 20 years in cybersecurity, including Global CISO roles. He is GRCP certified and a Certified Lead Implementer for ISO 27001, ISO 27701 and ISO 42001. GRC OS is how he'd want an AI to work on a programme he was accountable for: start from the business's real context, write controls an auditor can test, keep everything private by default, and leave every decision with a named human.
[!IMPORTANT]
GRC OS produces drafts for review by a competent person. It doesn't certify compliance, replace an auditor or give legal advice. See the disclaimer.
What is GRC OS?
A Claude Code project is just a folder. When you start claude inside it, Claude reads that folder's instructions, skills and settings. GRC OS is a folder set up so that Claude behaves like an experienced GRC practitioner:
| Layer | File | What it does |
|---|
| Operating instructions | CLAUDE.md | Claude's role, how it adapts to your experience level, and the non-negotiable guardrails |
| Skills | .claude/skills/ | The eleven GRC Skills: company context, risk, AI impact, policies, audit readiness, evidence, Cyber Essentials and DPIAs |
| Permissions | .claude/settings.json | Conservative defaults: Claude can write only to your workspace, and asks before fetching web pages or changing its own instructions |
| Your workspace | grc/ | Your programme's data, as Markdown and CSV. Git-ignored, so it never lands in a public repo |
| Worked example | examples/acme-analytics/ | A fictional company's programme, so you can see the outputs before you start |
GRC OS or GRC Skills?
| GRC Skills | GRC OS (this repo) |
|---|
| What it is | A library of portable skills | A ready-to-run workspace |
| Install | npx skills add grcmana/grcskills into any project | git clone, then open in Claude Code |
| Works with | Claude Code, Codex, Cursor and other Agent Skills agents | Claude Code |
| Includes | Skills and framework knowledge | All the skills, plus operating instructions, guardrails, permissions, a private workspace and a worked example |
| Best for | Adding GRC capability to an existing setup | Running your programme end to end |
How it works
You ──── "A customer wants ISO 27001. Where do we start?"
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ Claude Code │
│ ┌───────────────────────────────────────────────────────────┐ │
│ │ CLAUDE.md: role · guardrails · human approval │ │
│ └───────────────────────────────────────────────────────────┘ │
│ ┌───────────────────────────────────────────────────────────┐ │
│ │ .claude/skills/: 11 GRC skills + framework knowledge │ │
│ └───────────────────────────────────────────────────────────┘ │
└────────────────────────────────┬────────────────────────────────┘
│ reads and writes
▼
┌─────────────────────────────────────────────────────────────────┐
│ grc/ (private, git-ignored) │
│ context/ · risks/ · policies/ · evidence/ · audits/ · runs/ │
└─────────────────────────────────────────────────────────────────┘
A typical programme follows this path. Claude suggests the next step as you go:
company-context ──► risk-register ──► policy-writer ──► audit-readiness
│ │
│ ┌─────────────────────────────────────────┘
│ ▼
│ evidence-request-list ──► evidence-review ──► grc-status ─┐
│ ▲ │
│ └───────┘
│ monthly
└── as needed: ai-impact-assessment · dpia ·
cyber-essentials-scoping · policy-gap-review
Getting started
What you need
- Claude Code, installed and signed in.
git.- About 15 minutes for your first useful output.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
