GRCEngClub/claude-grc-engineering

Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks, multi-framework gap reports, OSCAL workflows.

What it solves

This project provides a toolkit for automating Governance, Risk, and Compliance (GRC) tasks. It transforms technical evidence from cloud providers, SaaS tools, and codebases into framework-aligned findings, gap reports, and remediation guidance, treating compliance as an engineering problem that is repeatable and versioned.

How it works

The toolkit operates as a plugin marketplace for the Claude ecosystem (Claude Code, Claude Desktop, and Claude Cowork). It uses a pipeline model where connector plugins collect evidence from sources like AWS, GitHub, and Okta, normalize it into a standard "Finding" schema, and then use the grc-engineer hub to map these findings against the Secure Controls Framework (SCF) and various compliance frameworks (e.g., SOC 2, NIST 800-53, ISO 27001).

Who it’s for

It is designed for GRC practitioners, security engineers, auditors, and platform teams who want to automate their compliance workflows and integrate them into their technical environment.

Highlights

  • Multi-Framework Support: Maps evidence to a wide array of standards including SOC 2, FedRAMP, HIPAA, and GDPR.
  • Extensible Plugin System: Includes specialized plugins for different personas (auditors, internal GRC), connectors for various cloud/SaaS tools, and diagramming tools for draw.io.
  • Automated Remediation: Generates remediation code, scripts, and policies to close compliance gaps.
  • OSCAL Integration: Provides tooling for FedRAMP/OSCAL workflows and SSP/SAR/POA&M outputs.
  • Unified Data Contract: Uses a versioned Finding schema to ensure consistency across different evidence connectors.

Related

  • Project
    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    A collection of installable knowledge packages for Claude that provide expert-level guidance and documentation tools for over 30 global Governance, Risk, and Compliance (GRC) frameworks.

  • Project
    intuitem/ciso-assistant-community

    A comprehensive cybersecurity management and GRC platform that simplifies compliance and risk management by decoupling security controls from compliance frameworks.

  • Project
    anombyte93/prd-taskmaster

    An open-source engine for Claude Code that turns goals into verified code via graded PRDs, dependency-ordered task graphs, and evidence-based execution.

  • Project
    mhattingpete/claude-skills-marketplace

    A curated marketplace of plugins, skills, and agents for Claude Code that automates software engineering workflows and provides a local execution runtime for token-efficient bulk operations.

  • Project
    scaccogatto/okf-skills

    okf‑skills is a Claude Code plugin and skill set that lets agents create, validate, and visualise knowledge bundles in the Open Knowledge Format (OKF) v0.2. It provides a deterministic validator, a self‑contained interactive HTML graph, a CI‑gate GitHub Action, and optional automatic upkeep hooks—all without any backend services.