Governance documentation,
engineered like software.

Reference-grade

The GRC Library is a complete, cross-referenced set of governance, risk, and compliance documentation, charters, policies, procedures, standards, registers, and templates, written to be adopted and adapted by any organization. It is a public corpus of openly-licensed reference documentation, whose original content is released under CC BY-SA 4.0 (vendored third-party material and quotations keep their own licences; see NOTICE), that enterprises, Crown and public-sector bodies, regulated institutions, security and compliance teams, auditors, and startups can freely read, cite, adopt, and tailor to their own context.

Your entry points

New here? Adopt the library in a few steps. Everything below is already in the corpus, ready to lift and adapt to your own organization, nothing to install.

Governed like code

What makes the library different is the toolchain behind it. The corpus is governed by a stdlib-only Python audit programme: a detailed, continuously-expanding suite of automated quality gates that run in CI on every change and keep the documentation internally consistent, citable, and free of drift.

For AI-assisted teams

This corpus is maintained largely by an AI assistant, working under a compact, open pack of governance rules and skills that keep it honest: evidence before assertion, no quality gate weakened to force a pass, ambiguity surfaced before action, and integrity ahead of speed. GRC-original rules ship under the same CC BY-SA 4.0 license as the corpus's own text, and are written to be lifted straight into any AI-assisted project, not only this one.

132 pinned AIQT rules (83 AIQT principles + 49 security rules), 15 retained GRC compatibility procedures, and 24 skills. GRC-original material remains CC BY-SA 4.0; the upstream AIQT snapshot is separately Apache-2.0 with its LICENSE and NOTICE retained. The snapshot uses exact commit a3ff734ca855e4363f340eca52fbd87272c51854, not a tagged release.

The full corpus

The corpus spans 360 documents across 12 governance domains. Every count here is recomputed from the generated taxonomy on each change, so the numbers stay current.

The per-domain counts in the table sum to 358; the remaining 2 of the 360 total documents are programme-level specifications that sit at the corpus root rather than inside any one domain.

Grounded in the standards

The library maps its controls and citations to the recognized standards, regulations, and frameworks below. Each is recorded, with its current edition, in a canonical citations register that the toolchain checks for currency, so a citation cannot silently name a superseded edition.

Open for reuse

The library's original content is released under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0); vendored third-party material and quotations keep their own licences (see NOTICE). Enterprises, Crown and public-sector bodies, regulated institutions, and smaller teams alike can adopt any part of it, adapt it to their own context, and put it to work internally and commercially. When you share the material or an adaptation of it, give attribution to the GRC Library as the source and indicate any changes.