jposluns/grc_library

**Date:** 2026-10-16\
**Classification:** Public\
**Confidentiality:** Public\
**License:** CC BY-SA 4.0\
**SPDX-License-Identifier:** CC-BY-SA-4.0\
**Library Version:** 2026.10.1507 (CalVer, library-wide; see specification-master-project.md §4.5)\
**README Version:** 1.11.594 (semantic per-document version for this file)
---
New to GRC? Start here
**GRC** stands for **Governance, Risk, and Compliance**: three interlocking disciplines an organization uses to align its activities with strategy, manage uncertainty, and meet legal, regulatory, and contractual obligations.
- **Governance** establishes who decides, who is accountable, and how decisions are made. Charters, policies, role registers, and approval-authority models are governance artefacts.
- **Risk management** identifies, evaluates, and treats threats to the organization's objectives. Risk registers, treatment plans, and acceptance records are risk artefacts.
- **Compliance** ensures that the organization meets external obligations (laws, regulations, standards, contracts) and internal policy. Obligation registers, control mappings, and audit-evidence packages are compliance artefacts.
In modern programmes the boundaries between the three overlap with **security** (protecting information and systems), **privacy** (handling personal data lawfully), **resilience** (continuing operations under disruption), **supplier/third-party governance** (managing risk that originates outside the organization), and **AI governance** (managing the risk introduced by AI systems). This library treats all of those as sibling domains under the GRC umbrella because organizations operate them together.
**This README orients first-time readers and contributors to the library as a whole.** Most adopters do not need to read it end-to-end. If you already know what you are here for, the canonical adopter entry is docs/portal.md, which routes by role and intent:
| If you are ... | Start at |
| --- | --- |
| New to GRC, or evaluating the library | Continue reading Purpose below, then docs/portal.md. |
| Unsure which documents apply to your situation | docs/decision-tree.md (the guided reading-order decision tree), then docs/portal.md. |
| An adopter setting up a programme | docs/portal.md (canonical front door), then docs/adopter-guide.md and docs/template-quickstart.md. |
| An auditor or reviewer assessing scope | docs/portal.md and governance/register-document-index-and-classification.md. |
| A maintainer or contributor | CONTRIBUTING.md and specification-master-project.md. |
| Looking up an unfamiliar acronym or regulator | governance/register-glossary.md and governance/register-key-terms-and-definitions.md. |
---
Purpose
The Governance, Risk, and Compliance Documentation Library is a Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0; full licence text in LICENSE) reference set for building an organization-neutral governance, risk, compliance, security, privacy, resilience, supplier, and artificial intelligence governance programme.
The library is designed to be adopted, adapted, or extended by any organization without retaining references to a specific company, individual, internal system, customer, vendor, geography, or operating environment.
The repository provides reusable artefacts across the following thematic areas:
- Enterprise governance, risk, compliance, audit, and assurance.
- Information security, identity, access, logging, data classification, incident response, and secure engineering.
- Privacy, data protection, retention, breach response, and data subject rights.
- Artificial intelligence governance, data security, model risk, lifecycle control, and assurance.
- Business continuity, crisis management, disaster recovery, and operational resilience.
- Supplier, third-party, cloud, and supply-chain governance.
- Cross-framework mapping, regulatory applicability analysis, and metrics.
- Crypto-asset and blockchain governance: classification, custody, key control, and platform risk.
The eight thematic areas above span 12 governance domain directories, and the library grows by routine PR cadence; the current document inventory is machine-generated on every change and lives in taxonomy.yml (one row per active artefact with canonical metadata). For an audience-keyed view of the same inventory, see docs/portal.md. The compliance/ domain hosts sector-conditional sub-directories (compliance/logistics/, compliance/financial-services/, compliance/healthcare/, and others) for organizations operating in those sectors or participating in covered programmes.