A curated list of awesome resources for Governance, Risk Management, and Compliance (GRC) professionals.
This list is intended for compliance officers, risk managers, auditors, and cybersecurity professionals or for people with a compliance need who need trusted resources for ISO 27001, SOC 2, SOX, ESG compliance, and more.
- SOC Reports (SOC 1/2/3) - AICPA Service Organization Control reports. SOC 1 for financial reporting controls, SOC 2 for security/availability/confidentiality/processing integrity/privacy controls, SOC 3 for public distribution.
- ISO/IEC 27001 - International standard for establishing an Information Security Management System (ISMS). Requires annual certification audits.
- ISO/IEC 27002 - Implementation guidance for ISO 27001 controls.
- ISO/IEC 27017 - Cloud security controls based on ISO 27002.
- ISO/IEC 27018 - Code of practice for protecting personally identifiable information in public cloud.
- ISO/IEC 27701 - Privacy Information Management System (PIMS) extension to ISO 27001.
- NIST Cybersecurity Framework - Voluntary risk-based model for managing cybersecurity risk (Identify, Protect, Detect, Respond, Recover).
- NIST Risk Management Framework - Framework for integrating security and risk management into system development lifecycle.
- NIST SP 800-53 - Security and privacy controls for federal information systems and organizations. Widely adopted beyond government.
- NIST SP 800-171 - Protecting Controlled Unclassified Information in nonfederal systems.
- NIST AI RMF - AI Risk Management Framework for trustworthy AI development and deployment.
- NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security for operational technology environments.
- NIST SP 800-160 - Systems Security Engineering for developing trustworthy secure systems.
- NIST SP 800-161 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
- NIST SP 800-172 - Enhanced Security Requirements for Protecting Controlled Unclassified Information.
- NIST SP 800-218 - Secure Software Development Framework (SSDF) for integrating security into SDLC.
- NIST SP 800-63B - Digital Identity Guidelines for authentication and lifecycle management.
- NIST SP 800-66 - Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.
- NIST Privacy Framework - Tool for improving privacy risk management.
- PCI DSS - Payment Card Industry Data Security Standard. Required for handling credit card data. Version 4.0 emphasizes continuous compliance.
- HIPAA - US Health Insurance Portability and Accountability Act. Mandates safeguards for protected health information.
- HITRUST CSF - Common certifiable framework combining HIPAA, NIST, ISO, and other requirements for healthcare.
- HICP - Health Industry Cybersecurity Practices for healthcare organizations (small, medium, and large practice guidance).
- FedRAMP - Federal Risk and Authorization Management Program. Required for cloud services used by US federal agencies based on NIST 800-53.
- CMMC - Cybersecurity Maturity Model Certification for US DoD contractors. Version 2.0 streamlines requirements.
- FISMA - Federal Information Security Modernization Act for US federal agency information security.
- StateRAMP - Standardized approach to cloud security for US state and local governments.
- FERPA - Family Educational Rights and Privacy Act protecting student education records.
- Microsoft SSPA - Microsoft Security Software Privacy Assurance framework.
- CIS Controls - Center for Internet Security 18 Critical Security Controls (formerly 20).
- CIS Benchmarks - Configuration security benchmarks for systems and applications.
- CSA Cloud Controls Matrix - Cloud Security Alliance control framework for cloud computing.
- MITRE ATT&CK - Knowledge base of adversary tactics and techniques based on real-world observations.
- OWASP ASVS - Application Security Verification Standard.
- CPS234 - Australian Prudential Regulation Authority information security requirements.
- CISA - Cybersecurity Information Sharing Act and CISA agency resources.
- NERC CIP - North American Electric Reliability Corporation Critical Infrastructure Protection standards.
- CJIS - Criminal Justice Information Services Security Policy.
- Secure Control Framework - Comprehensive control framework with mappings across multiple standards and regulations.
- NIST National Online Informative References Program (OLIR) - Machine-readable mappings between NIST frameworks and other standards.
- Adobe Common Controls Framework - Adobe's unified control framework for compliance.
- Equifax Security Controls Framework - Equifax's control framework with mappings to major standards.
- CIS Controls Navigator - Tool for navigating and implementing CIS Controls.
- MITRE NIST 800-53 to ATT&CK Mappings - Maps NIST security controls to adversary techniques.
- NIST AI RMF Crosswalks - Mappings between AI RMF and other frameworks, standards, and regulations.
- CSF Tools - Tools and resources for implementing the NIST Cybersecurity Framework.
- B Corp Certification - Certification for companies meeting high standards of social and environmental performance.
- CDP - Carbon Disclosure Project for environmental impact reporting.
- GRI Standards - Global Reporting Initiative for sustainability reporting.
- ISO 14001 - Environmental Management Systems.
- ISO 45001 - Occupational Health and Safety Management Systems.
- ISO 50001 - Energy Management Systems.
- SASB Standards - Sustainability Accounting Standards Board standards for ESG disclosure.
- TCFD - Task Force on Climate-related Financial Disclosures recommendations.
- UN SDGs - United Nations Sustainable Development Goals.
- SOX - Sarbanes-Oxley Act for financial reporting and corporate governance.
- SOX ITGC - IT General Controls for Sarbanes-Oxley compliance.
- Basel Framework - International banking regulations on capital adequacy, stress testing, and market liquidity.
- FCRA - Fair Credit Reporting Act regulating credit information collection and use.
- IFRS - International Financial Reporting Standards for accounting and financial reporting.
- GLBA - Gramm-Leach-Bliley Act requiring financial institutions to protect customer information.
- NYDFS - New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500).
- SWIFT CSF - SWIFT Customer Security Controls Framework for financial messaging and payment systems.
- FFIEC - Federal Financial Institutions Examination Council cybersecurity assessment tool.
- FINRA - Financial Industry Regulatory Authority cybersecurity requirements for broker-dealers.
- SAMA CSF - Saudi Arabian Monetary Authority Cyber Security Framework for financial sector.
- EBA ICT Guidelines - European Banking Authority ICT and security risk management guidelines.
- OFDSS - Office of Federal Student Aid Security Standards.
- ISO 9001 - Quality Management Systems standard.
- AS9100 - Quality management for aerospace industry.
- ISO 13485 - Quality management for medical devices.
- ISO 22000 - Food Safety Management Systems.
- ISO/TS 16949 - Quality management for automotive industry (superseded by IATF 16949).
- ISO 22301 - Security and resilience business continuity management systems requirements.
- cGMP - Current Good Manufacturing Practice for pharmaceuticals.
- FDA 21 CFR Part 11 - Electronic records and electronic signatures in FDA-regulated industries.
- IEC TR 60601-4-5 - Medical electrical equipment cybersecurity requirements.
- IEC 62443-4-2 - Security for industrial automation and control systems technical requirements.
- ISO/SAE 21434 - Road vehicles cybersecurity engineering standard.
- UN R155 - UN Regulation cybersecurity and cyber security management system for vehicles.
- TISAX - Trusted Information Security Assessment Exchange for automotive industry information security assessment.
- ITIL - Information Technology Infrastructure Library for IT service management.
- COBIT - Control Objectives for Information and Related Technologies governance framework.
- ISO 42001 - AI Management System standard.
- COSO ERM - Committee of Sponsoring Organizations Enterprise Risk Management framework.
- FAIR - Factor Analysis of Information Risk, quantitative risk analysis framework.
- ISO 27005 - Information security risk management.
- ISO 31000 - Risk management guidelines and principles.
- NIST SP 800-37 - Risk Management Framework for Information Systems.
- NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View.
- OCTAVE - Operationally Critical Threat, Asset, and Vulnerability Evaluation by Carnegie Mellon.
- Rapid Risk Assessment - Mozilla's lightweight risk assessment methodology.
- TARA - Threat Assessment and Remediation Analysis by MITRE.
- IAPP US Federal Privacy Legislation Tracker - Comprehensive tracking of 50+ federal privacy bills in the 118th Congress (2023-2024).
- IAPP US State Privacy Legislation Tracker - Comprehensive tracking of state privacy legislation across all US states.
- CCPA/CPRA - California Consumer Privacy Act and California Privacy Rights Act. Comprehensive consumer privacy rights including data deletion, opt-out, and transparency requirements.
- Virginia CDPA - Virginia Consumer Data Protection Act establishing consumer privacy rights and business obligations.
- Colorado CPA - Colorado Privacy Act providing consumer data privacy rights similar to CCPA.
- GDPR - EU General Data Protection Regulation governing personal data protection. Self-attestation via Data Protection Officer with demonstrated compliance.
- GDPR-info.eu - Complete GDPR text with recitals and commentary.
- GDPR Expert - GDPR compliance resources.
- GDPRhub - Free and open database of GDPR case law.
- NIS2 Directive - EU Network and Information Security Directive establishing cybersecurity requirements for critical infrastructure and digital services.
- EU DORA - Digital Operational Resilience Act for financial sector ICT risk management in the EU.
- ePrivacy Directive - EU directive on privacy and electronic communications (under revision).
- ENISA Guidelines - European Union Agency for Network and Information Security technical guidelines and security measures.
- EU AI Act - Comprehensive AI regulation with risk-based approach, prohibitions on high-risk uses, and transparency requirements. First comprehensive AI law globally.
- Openlane - Comprehensive compliance automation platform for SOC 2, ISO 27001, and custom frameworks (Apache-2.0). Transforms compliance from static annual process to continuous collaborative workflow with risk register, policy management, evidence lifecycle, and control validation. (GitHub | Docs)
- Comply - SOC 2 compliance automation framework by StrongDM (Apache-2.0). Provides markdown-based policy templates and document pipeline for auditor-ready policies.
- Compliance Masonry - CLI tool to build compliance documentation using OpenControl YAML schema. Supports FedRAMP, NIST, and other frameworks.
- Auditree Framework - IBM's framework for automated evidence collection and verification (Apache-2.0). Treats compliance checks as code with version-controlled evidence locker.
- Trestle - IBM's compliance-as-code toolset using NIST's OSCAL format. Manages compliance catalogs and automates documentation generation.
- InSpec - Chef's compliance and security testing framework. Write automated compliance tests in Ruby DSL with pre-built profiles for CIS, DISA STIGs.
- OpenSCAP - Security Content Automation Protocol toolset for automated system scanning against SCAP benchmarks (Red Hat sponsored).
- Lynis - Security auditing tool for Unix/Linux systems. Performs host configuration scans and generates hardening reports.
- Cloud Custodian - CNCF Sandbox rules engine for cloud compliance. Write policies in YAML to enforce and remediate violations in AWS, Azure, GCP.
- Prowler - AWS security and compliance scanner. Checks against AWS CIS Benchmark, GDPR, HIPAA, PCI DSS, SOC 2.
- ScoutSuite - Multi-cloud security auditing tool by NCC Group. Detects misconfigurations in AWS, Azure, GCP.
- Steampipe - Query cloud and SaaS APIs as SQL tables. Includes compliance mod packs for CIS AWS Foundations, HIPAA, PCI.
- PacBot - T-Mobile's cloud compliance platform. Continuously monitors AWS for violations with auto-remediation capabilities.
- OSQuery - Endpoint monitoring using SQL queries (Linux Foundation). Query running processes, configurations, and compliance-related data across fleet.
- Wazuh - Open source security platform with SIEM and HIDS capabilities. Provides compliance rule sets for PCI DSS, GDPR, HIPAA with reporting.
- CISO Assistant - Open-source GRC app supporting 40+ frameworks. Manages risks, controls, audits with one-click audit reports.
- Comp AI - Open source compliance platform (AGPL-3.0) for SOC 2, ISO 27001, HIPAA, GDPR.
- Eramba - Enterprise GRC platform with free Community Edition. Modules for compliance, risk management, incidents, vendor assessments.
- Trivy - Comprehensive security scanner for containers and IaC. Detects vulnerabilities, misconfigurations, secrets.
- kube-bench - Checks Kubernetes clusters against CIS Kubernetes Benchmark.
- Kyverno - Kubernetes-native policy management. Enforce, validate, and mutate configurations.
- OPA Gatekeeper - Policy controller for Kubernetes using Open Policy Agent.
- Havengrc - Open-source GRC platform for compliance management.
- GGRC Core - Google's governance, risk, and compliance platform (archived but historically significant).
- Govready - Open-source GRC platform for automated compliance assessments.
- Probo - Open source compliance automation focused on continuous integration workflows.
- Drata - Cloud platform for continuous compliance monitoring and automation. Connects to tech stack for evidence collection. Supports SOC 2, ISO 27001, PCI DSS.
- Vanta - Compliance automation platform for SOC 2, ISO 27001. Continuous monitoring with AI-powered questionnaire responses.
- Secureframe - End-to-end compliance platform for SOC 2, ISO 27001, HIPAA. Includes policy templates, evidence collection, training, auditor coordination.
- Tugboat Logic - Security assurance platform now part of OneTrust. Automated evidence collection and audit project management.
- Tenable - Cloud-based and On-prem vulnerability and exposure management.
- Hyperproof - Compliance operations platform for ongoing risk and compliance management. Workflow automation and continuous control monitoring.
- Sprinto - Automated compliance platform for SOC 2, ISO 27001, GDPR, HIPAA.
- Oneleet - Continuous compliance monitoring and automation platform.
- Scrut - Automated compliance platform with integrations for real-time monitoring.
- Thoropass - Information security and compliance software.
- AuditBoard - Leading platform for audit and compliance management. One-stop solution for managing audits, controls, risks, and reporting.
- Archer - RSA's GRC platform widely used in enterprises.
- LogicGate - Risk Cloud platform tailored for IT Risk, Compliance, Third-Party Risk.
- MetricStream - Enterprise GRC platform for integrated risk management.
- Onspring - No-code GRC platform for risk, compliance, and audit management.
- OneTrust - Privacy, security, and data governance platform. Extensive GRC suite including Vendorpedia.
- ServiceNow GRC - Integrated risk and compliance management on ServiceNow platform.
- TrustCloud - GRC platform with free trust center offering. Compliance tracking with integrations. (Freemium)
- Benchmark ESG - ESG data management and reporting platform.
- Diligent ESG - ESG governance and reporting solution.
- Locus Technologies - Environmental, health, safety, and sustainability management software.
- Novata - ESG data management for private markets.
- Novisto - ESG reporting automation platform.
- Proof - ESG performance management platform.
- Sametrica - ESG impact measurement software.
- Workiva - Cloud platform for ESG, financial, and compliance reporting.
- AWS Artifact - Access AWS compliance reports (SOC, ISO, PCI, etc.).
- Azure Compliance - Microsoft Azure compliance documentation and reports.
- GCP Compliance - Google Cloud compliance resources and certifications.
- Unified Compliance Framework - Common Controls Hub with 1000+ mapped authorities (Commercial).
- NIST OSCAL - Open Security Controls Assessment Language for machine-readable compliance.
- OpenControl - YAML-based compliance documentation framework.
- ComplianceForge - Commercial policy libraries and toolkits for multiple frameworks.
- Regulations.gov - US federal regulations repository.
