GRC Skill

Support Governance, Risk, and Compliance activities with policy generation, control assessment, risk management, and compliance tracking.

Capabilities

• Policy Management: Generate and track security policies

• Control Assessment: Document and assess control effectiveness

• Risk Management: Maintain risk registers and assessments

• Compliance Tracking: Track compliance with multiple frameworks

• Audit Support: Generate audit evidence and reports

• Framework Mapping: Map controls across frameworks

Quick Start

from grc_utils import PolicyGenerator, ControlAssessment, RiskRegister, ComplianceTracker

Generate a policy

policy = PolicyGenerator('Access Control Policy') policy.add_section('Purpose', 'Define access control requirements...') policy.add_control('AC-1', 'Users must use unique identifiers') print(policy.generate())

Assess a control

assessment = ControlAssessment('AC-1', 'Access Control') assessment.set_effectiveness('effective') assessment.add_evidence('access_review_report.pdf', 'Quarterly access review')

Track compliance

tracker = ComplianceTracker('SOC 2') tracker.add_control('CC6.1', status='compliant') print(tracker.get_compliance_status())

Usage

Policy Management

Generate and manage security policies.

Example:

from grc_utils import PolicyGenerator

Create policy

policy = PolicyGenerator( title='Information Security Policy', version='1.0', owner='CISO', classification='Internal' )

Add sections

policy.add_section( 'Purpose', '''This policy establishes the information security requirements for protecting organizational assets and data.''' )

policy.add_section( 'Scope', '''This policy applies to all employees, contractors, and third parties with access to organizational systems.''' )

policy.add_section( 'Policy Statements', '''1. All users must complete security awareness training annually. 2. Multi-factor authentication is required for all remote access. 3. Data must be classified and handled according to its sensitivity.''' )

Add controls

policy.add_control('AC-1', 'Access control policy and procedures') policy.add_control('AC-2', 'Account management') policy.add_control('AT-1', 'Security awareness training')

Set review schedule

policy.set_review_schedule(frequency='annual', next_review='2025-01-01')

Generate outputs

print(policy.generate()) # Markdown format print(policy.to_json()) # JSON for storage

Control Assessment

Document and assess control effectiveness.

Example:

from grc_utils import ControlAssessment

Create assessment

assessment = ControlAssessment( control_id='AC-2', control_name='Account Management', framework='NIST 800-53' )

Set control details

assessment.set_description(''' The organization manages information system accounts, including:

• Identifying account types
• Establishing conditions for group membership
• Identifying authorized users
• Specifying access privileges ''')

Document implementation

assessment.set_implementation(''' Account management is implemented through:

• Active Directory for identity management
• Privileged Access Management (PAM) solution
• Quarterly access reviews
• Automated deprovisioning workflows ''')

Add evidence

assessment.add_evidence( filename='access_review_q4_2024.pdf', description='Q4 2024 access review report', date_collected='2024-01-15' )

assessment.add_evidence( filename='pam_config_screenshot.png', description='PAM solution configuration', date_collected='2024-01-10' )

Set effectiveness

assessment.set_effectiveness( rating='effective', notes='Control operating as intended with minor documentation gaps' )

Identify gaps

assessment.add_gap( description='Service account reviews not documented', remediation='Implement service account review process', priority='Medium', due_date='2024-03-01' )

Generate report

print(assessment.generate_report())

Risk Management

Maintain risk registers and assessments.

Example:

from grc_utils import RiskRegister

register = RiskRegister()

Add risks

register.add_risk( risk_id='RISK-001', title='Ransomware Attack', description='Risk of ransomware infection causing data loss and operational disruption', category='Cybersecurity', likelihood='medium', impact='high', inherent_risk='high' )

register.add_risk( risk_id='RISK-002', title='Third-Party Data Breach', description='Risk of data breach through third-party vendor', category='Third Party', likelihood='medium', impact='medium', inherent_risk='medium' )

Add controls/mitigations

register.add_mitigation( risk_id='RISK-001', control='Endpoint Detection and Response (EDR)', effectiveness='high' )

register.add_mitigation( risk_id='RISK-001', control='Backup and Recovery Solution', effectiveness='high' )

Calculate residual risk

register.calculate_residual_risk('RISK-001')

Set treatment

register.set_treatment( risk_id='RISK-001', treatment='mitigate', owner='Security Operations', notes='Continuing to enhance detection and response capabilities' )

Generate risk report

print(register.generate_report()) print(register.generate_heatmap_data())

Compliance Tracking

Track compliance across frameworks.

Example:

from grc_utils import ComplianceTracker

Create tracker for SOC 2

tracker = ComplianceTracker('SOC 2 Type II')

Add controls with status

tracker.add_control( control_id='CC6.1', description='Logical and physical access controls', status='compliant', evidence=['access_control_policy.pdf', 'access_review_q4.xlsx'] )

tracker.add_control( control_id='CC6.2', description='Access credentials management', status='compliant', evidence=['mfa_implementation.pdf'] )

tracker.add_control( control_id='CC6.3', description='Access removal', status='partially_compliant', evidence=['termination_checklist.pdf'], gaps=['Delayed offboarding for contractors'] )

tracker.add_control( control_id='CC7.1', description='Detection of unauthorized changes', status='non_compliant', gaps=['FIM not fully implemented'] )

Get compliance status

status = tracker.get_compliance_status() print(f"Compliant: {status['compliant']}") print(f"Partially Compliant: {status['partially_compliant']}") print(f"Non-Compliant: {status['non_compliant']}")

Generate compliance report

print(tracker.generate_report())

Framework Mapping

Map controls across multiple frameworks.

Example:

from grc_utils import FrameworkMapper

mapper = FrameworkMapper()

Add control mappings

mapper.add_mapping( control_name='Access Control Policy', mappings={ 'NIST 800-53': 'AC-1', 'ISO 27001': 'A.9.1.1', 'SOC 2': 'CC6.1', 'CIS': 'Control 6.1' } )

mapper.add_mapping( control_name='Multi-Factor Authentication', mappings={ 'NIST 800-53': 'IA-2(1)', 'ISO 27001': 'A.9.4.2', 'SOC 2': 'CC6.1', 'CIS': 'Control 6.5' } )

Get control by framework

nist_controls = mapper.get_by_framework('NIST 800-53')

Find equivalent controls

equivalents = mapper.find_equivalents('NIST 800-53', 'AC-1')

Generate mapping matrix

print(mapper.generate_matrix())

Audit Support

Generate audit evidence and reports.

Example:

from grc_utils import AuditPackage

audit = AuditPackage( audit_name='SOC 2 Type II 2024', period_start='2024-01-01', period_end='2024-12-31' )

Add evidence

audit.add_evidence( request_id='RQ-001', description='Access control policy', filename='access_control_policy_v2.1.pdf', control_ids=['CC6.1', 'CC6.2'], provided_by='security-team', date_provided='2024-01-15' )

audit.add_evidence( request_id='RQ-002', description='Quarterly access reviews', filename='access_reviews_2024.xlsx', control_ids=['CC6.1'], provided_by='it-team', date_provided='2024-01-16' )

Track findings

audit.add_finding( finding_id='FIND-001', description='Delayed access removal for terminated employees', severity='Medium', control_ids=['CC6.3'], management_response='Implementing automated deprovisioning', remediation_date='2024-03-01' )

Generate audit package

print(audit.generate_evidence_index()) print(audit.generate_finding_summary())

Configuration

Environment Variables

Variable Description Required Default

GRC_OUTPUT_DIR

Output directory for reports No ./output

GRC_TEMPLATE_DIR

Directory for policy templates No ./templates

Supported Frameworks

• NIST 800-53 - Security and Privacy Controls

• NIST CSF - Cybersecurity Framework

• ISO 27001 - Information Security Management

• SOC 2 - Service Organization Controls

• PCI DSS - Payment Card Industry

• HIPAA - Health Insurance Portability

• GDPR - General Data Protection Regulation

• CIS Controls - Center for Internet Security

Limitations

• No Database: Data stored in memory only

• No Workflow: Manual status updates required

• Template-Based: Limited customization

Troubleshooting

Invalid Risk Rating

Use valid risk rating values:

Valid ratings

register.add_risk(..., likelihood='high') # high, medium, low register.add_risk(..., impact='critical') # critical, high, medium, low

Invalid

register.add_risk(..., likelihood='very high') # Error!

Compliance Status Values

Use standard compliance statuses:

Valid

tracker.add_control(..., status='compliant') tracker.add_control(..., status='partially_compliant') tracker.add_control(..., status='non_compliant') tracker.add_control(..., status='not_applicable')

Related Skills

• vulnerability-management: Technical compliance

• docx: Policy document generation

• xlsx: Compliance tracking spreadsheets

References

• Detailed API Reference

• NIST 800-53 Rev 5

• ISO 27001:2022