Claude drafts.You approve.
A ready-to-run Claude Code workspace for ISO 27001, SOC 2, Cyber Essentials, GDPR and ISO 42001. Tell it about your company and it drafts your risk register, policies, readiness assessment and evidence plan, mapped to clause and control IDs, with every run logged.
git clone https://github.com/grcmana/grc-osNeeds Claude Code and git. Free under the MIT licence.
Ask a chat window for compliance and you get a document. Run GRC OS and you get a programme with an audit trail.
GRC OS is a Claude Code project folder, set up so that Claude works like an experienced GRC practitioner. It starts from your company profile, so outputs name your real tools, data and suppliers. Anything it doesn’t know becomes TBC and a question, never a guess.
It is built on the eleven GRC Skills, plus what a programme needs around them. Risk ratings, policy approval and audit conclusions stay proposals until a named person signs them off, and Claude never fills in an approval field.
Three steps to your first draft.
You need Claude Code, installed and signed in, and git. Allow about fifteen minutes for your first useful output.
- 01
Clone and open
Run
git clone https://github.com/grcmana/grc-os, then startclaudeinside thegrc-osfolder. - 02
Say hi
On a fresh workspace, GRC OS offers two paths: a five-minute tour of the worked example, or straight into your own programme.
- 03
Give it your context
Run
/company-context. Point Claude at your website, pitch deck, policies or a customer’s security questionnaire, or answer its questions in short batches.
More from GRCMANA.
A Claude Code project folder. When you start claude inside it, Claude reads its operating instructions, skills and permission settings, and works alongside you as a GRC practitioner would: drafting, mapping, tracking and explaining, while you make the decisions.
The founder, CTO or ops lead who has just been told a customer needs ISO 27001, SOC 2 or Cyber Essentials and doesn’t know where to start. And GRC practitioners and engineers who want to run programme work as code: versioned, repeatable and auditable.
Yes. GRC OS is a Claude Code workspace. If you use Codex, Cursor or another agent, install GRC Skills instead. They are the same skills, without the workspace around them.
Your programme lives in grc/ as Markdown and CSV. That folder is git-ignored, so nothing you create is pushed to the public GRC OS repo. To keep its history, make grc/ its own private repository.
Claude Code sends what Claude reads to Anthropic for processing, as it does in any project, so check that fits your own data policies. GRC OS tells Claude never to ask for, store or repeat credentials or individuals’ personal data.
The guardrails in CLAUDE.md. Risk ratings, acceptances, policy approval and audit conclusions stay proposals until a named person approves them, and Claude never fills in approved_by or approved_on. Instructions hidden in documents or web pages are shown to you, not followed.
No. GRC OS produces drafts for review by a competent person. It doesn’t certify compliance, replace an auditor or give legal advice. What it gives you is a faster, better-structured start, with every decision left to a named person.
Not with a dedicated skill yet; security questionnaires are on the roadmap. Today you can point /company-context at a questionnaire you’ve received, and the profile, risk register and policies it leads to give you the material to answer from.
Nothing. GRC OS is free and open source under the MIT licence. You need Claude Code to run it, and that is billed however you usually pay for it.
Run git pull. You get the latest skills, operating instructions and example, and your grc/ data is left untouched.
Harry West, at GRCMANA. Harry has spent around 20 years in cybersecurity, including Global CISO roles. GRC OS is how he’d want an AI to work on a programme he was accountable for.
Clone it and say hi.
Free, open source and MIT licensed. Bring your company context, and GRC OS brings the method.
git clone https://github.com/grcmana/grc-os