GRC OS: an AI Operating System for GRC

A ready-to-run Claude Code workspace for running a governance, risk and compliance programme. Clone it, open it in Claude Code, and Claude works as a senior GRC practitioner alongside you. It knows your company and follows a proven method, and it never signs anything off on your behalf.

It's built for two kinds of people:

• GRC practitioners and engineers who want to run programme work as code: versioned, repeatable and auditable.
• "Accidental" owners: the founder, CTO or ops lead who has just been told a customer needs ISO 27001, SOC 2 or Cyber Essentials, and doesn't know where to start.

It covers ISO 27001, SOC 2, Cyber Essentials, GDPR and ISO 42001, using the eleven skills from GRC Skills.

Built by Harry West, founder of GRCMANA. Harry has spent around 20 years in cybersecurity, including Global CISO roles. He is GRCP certified and a Certified Lead Implementer for ISO 27001, ISO 27701 and ISO 42001. GRC OS is how he'd want an AI to work on a programme he was accountable for: start from the business's real context, write controls an auditor can test, keep everything private by default, and leave every decision with a named human.

• New skills and updates: subscribe at grcskills.io.
• Problem with a skill, or a framework correction? Report it in GRC Skills. Problem with the workspace? Open an issue here.

[!IMPORTANT] GRC OS produces drafts for review by a competent person. It doesn't certify compliance, replace an auditor or give legal advice. See the disclaimer.

What is GRC OS?

A Claude Code project is just a folder. When you start claude inside it, Claude reads that folder's instructions, skills and settings. GRC OS is a folder set up so that Claude behaves like an experienced GRC practitioner:

Layer	File	What it does
Operating instructions	CLAUDE.md	Claude's role, how it adapts to your experience level, and the non-negotiable guardrails
Skills	.claude/skills/	The eleven GRC Skills: company context, risk, AI impact, policies, audit readiness, evidence, Cyber Essentials and DPIAs
Permissions	.claude/settings.json	Conservative defaults: Claude can write only to your workspace, and asks before fetching web pages or changing its own instructions
Your workspace	grc/	Your programme's data, as Markdown and CSV. Git-ignored, so it never lands in a public repo
Worked example	examples/acme-analytics/	A fictional company's programme, so you can see the outputs before you start

GRC OS or GRC Skills?

	GRC Skills	GRC OS (this repo)
What it is	A library of portable skills	A ready-to-run workspace
Install	npx skills add grcmana/grcskills into any project	git clone, then open in Claude Code
Works with	Claude Code, Codex, Cursor and other Agent Skills agents	Claude Code
Includes	Skills and framework knowledge	All the skills, plus operating instructions, guardrails, permissions, a private workspace and a worked example
Best for	Adding GRC capability to an existing setup	Running your programme end to end

How it works

   You ──── "A customer wants ISO 27001. Where do we start?"
                                  │
                                  ▼
 ┌─────────────────────────────────────────────────────────────────┐
 │  Claude Code                                                    │
 │  ┌───────────────────────────────────────────────────────────┐  │
 │  │ CLAUDE.md: role · guardrails · human approval             │  │
 │  └───────────────────────────────────────────────────────────┘  │
 │  ┌───────────────────────────────────────────────────────────┐  │
 │  │ .claude/skills/: 11 GRC skills + framework knowledge      │  │
 │  └───────────────────────────────────────────────────────────┘  │
 └────────────────────────────────┬────────────────────────────────┘
                                  │ reads and writes
                                  ▼
 ┌─────────────────────────────────────────────────────────────────┐
 │  grc/  (private, git-ignored)                                   │
 │  context/ · risks/ · policies/ · evidence/ · audits/ · runs/    │
 └─────────────────────────────────────────────────────────────────┘

A typical programme follows this path. Claude suggests the next step as you go:

  company-context ──► risk-register ──► policy-writer ──► audit-readiness
         │                                                       │
         │             ┌─────────────────────────────────────────┘
         │             ▼
         │   evidence-request-list ──► evidence-review ──► grc-status ─┐
         │                                                     ▲       │
         │                                                     └───────┘
         │                                                      monthly
         └── as needed:  ai-impact-assessment · dpia ·
                         cyber-essentials-scoping · policy-gap-review

Getting started

What you need

• Claude Code, installed and signed in.
• git.
• About 15 minutes for your first useful output.

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗