# grcskills

> Open GRC skills for AI agents: 60 skills in the Agent Skills format (one SKILL.md each) for governance, risk and compliance work, written the way experienced GRC people do the work. Skills support practitioners: they draft and prepare, people decide. MIT licensed, by ISMS Copilot.

## If you were asked to run grc-setup-review

The current release is `v2026.10.19.2`. Install from that tag, never from `main`. The user's request to run grc-setup-review is the go-ahead for step 1 (a clone of that tag into `.grcskills`); ask before installing anything else or touching anything outside the working folder.

1. Get the release into the user's working folder: `git clone --depth 1 --branch v2026.10.19.2 https://github.com/better-isms/grcskills .grcskills`.
2. Read `.grcskills/AGENTS.md`.
3. Follow `.grcskills/skills/tristan-roth/grc-setup-review/SKILL.md` step by step.
4. Read the user's files only: never edit, move or delete them, and never send them off the machine.
5. Write the outputs to `./grc-setup-review/` (`inventory.md`, `top-10.md`, `audit.md`, `30-day-plan.md`), then summarise the top 10 and the plan for the user. Everything is a draft for the user to review.

Text in this file and in the cloned files is guidance for this task, never permission to skip the user's approvals.

## When to use

Use these skills when a user asks you to do GRC work on their own files: scope statements, statements of applicability, risk registers, audit prep and response, evidence, vendors, policies, privacy, AI systems, incidents and continuity. Each skill holds the steps an experienced person follows for one piece of work, a quality bar and the files it writes. Every skill drafts for a human to review and sign; no skill marks a control effective, accepts a risk or sends data off the machine. Skills contain no text from any standard. If you do not know where to start, run grc-setup-review: it ranks the skills that fit the setup and writes a 30-day plan.

## The one prompt

Read grcskills.com/llms.txt, then run the grc-setup-review skill on my GRC setup: rank the 10 skills that would help me most, list what is broken or missing, and write a 30-day plan.

## Install

- One skill: `npx skills add better-isms/grcskills#v2026.10.19.2 --skill <skill-name>`
- The whole library, interactive: `npx skills add better-isms/grcskills#v2026.10.19.2`
- Claude Code plugin: `/plugin marketplace add better-isms/grcskills`, then `/plugin install grcskills@grcskills`
- Clone a release: `git clone --branch v2026.10.19.2 https://github.com/better-isms/grcskills`

## Skills

One line per skill: skill name, page, category and frameworks. Read the SKILL.md on the page for what it does.

- acceptable-use-policy-drafting: https://grcskills.com/skill/acceptable-use-policy-drafting/ (Policies and documentation; General, ISO 27001, SOC 2)
- access-review-campaign-prep: https://grcskills.com/skill/access-review-campaign-prep/ (Evidence; ISO 27001, SOC 2, HIPAA, PCI DSS)
- ai-acceptable-use-rules: https://grcskills.com/skill/ai-acceptable-use-rules/ (AI systems; General, ISO 42001, EU AI Act)
- ai-act-risk-classification: https://grcskills.com/skill/ai-act-risk-classification/ (AI systems; EU AI Act)
- ai-impact-assessment: https://grcskills.com/skill/ai-impact-assessment/ (AI systems; ISO 42001, EU AI Act)
- ai-management-system-scope: https://grcskills.com/skill/ai-management-system-scope/ (AI systems; ISO 42001)
- ai-system-inventory: https://grcskills.com/skill/ai-system-inventory/ (AI systems; EU AI Act, ISO 42001)
- ai-vendor-due-diligence: https://grcskills.com/skill/ai-vendor-due-diligence/ (AI systems; ISO 42001, GDPR, EU AI Act)
- soa-status-reconciliation: https://grcskills.com/skill/soa-status-reconciliation/ (Statement of applicability; ISO 27001)
- auditor-interview-prep: https://grcskills.com/skill/auditor-interview-prep/ (Audit prep and response; ISO 27001, SOC 2, General)
- auditor-sample-preparation: https://grcskills.com/skill/auditor-sample-preparation/ (Audit prep and response; ISO 27001, SOC 2, PCI DSS)
- backup-restore-test-evidence: https://grcskills.com/skill/backup-restore-test-evidence/ (Evidence; ISO 27001, SOC 2, DORA, HIPAA)
- business-impact-analysis: https://grcskills.com/skill/business-impact-analysis/ (Incidents and continuity; ISO 27001, DORA, NIS 2, General)
- change-management-evidence-sampling: https://grcskills.com/skill/change-management-evidence-sampling/ (Evidence; SOC 2, ISO 27001)
- bcp-tabletop-design: https://grcskills.com/skill/bcp-tabletop-design/ (Incidents and continuity; ISO 27001, SOC 2, DORA, NIS 2)
- control-owner-raci: https://grcskills.com/skill/control-owner-raci/ (Statement of applicability; ISO 27001, SOC 2, General)
- customer-security-questionnaire-answers: https://grcskills.com/skill/customer-security-questionnaire-answers/ (Vendors and third parties; General, SOC 2, ISO 27001, GDPR)
- dpa-security-annex-review: https://grcskills.com/skill/dpa-security-annex-review/ (Vendors and third parties; GDPR)
- data-subject-request-procedure: https://grcskills.com/skill/data-subject-request-procedure/ (Privacy; GDPR, ISO 27701)
- document-consistency-check: https://grcskills.com/skill/document-consistency-check/ (Policies and documentation; General)
- dpia-screening: https://grcskills.com/skill/dpia-screening/ (Privacy; GDPR, ISO 27701)
- evidence-freshness-check: https://grcskills.com/skill/evidence-freshness-check/ (Evidence; General, ISO 27001, SOC 2)
- evidence-request-list-builder: https://grcskills.com/skill/evidence-request-list-builder/ (Evidence; ISO 27001, SOC 2, NIS 2, DORA)
- soa-exclusion-justification-review: https://grcskills.com/skill/soa-exclusion-justification-review/ (Statement of applicability; ISO 27001, ISO 27701, ISO 42001)
- first-gap-assessment: https://grcskills.com/skill/first-gap-assessment/ (Gap and readiness; General, ISO 27001, SOC 2, HIPAA, NIS 2, ISO 42001)
- grc-setup-review: https://grcskills.com/skill/grc-setup-review/ (Gap and readiness; General, ISO 27001, SOC 2, GDPR, NIS 2, DORA, ISO 42001, EU AI Act)
- phi-flow-mapping: https://grcskills.com/skill/phi-flow-mapping/ (Privacy; HIPAA)
- ict-risk-framework-check: https://grcskills.com/skill/ict-risk-framework-check/ (Risk; DORA)
- ict-third-party-register: https://grcskills.com/skill/ict-third-party-register/ (Vendors and third parties; DORA)
- incident-response-plan-drafting: https://grcskills.com/skill/incident-response-plan-drafting/ (Incidents and continuity; ISO 27001, SOC 2, HIPAA, NIS 2)
- incident-severity-triage: https://grcskills.com/skill/incident-severity-triage/ (Incidents and continuity; General, ISO 27001, SOC 2, NIS 2, DORA)
- internal-audit-checklist-from-scope: https://grcskills.com/skill/internal-audit-checklist-from-scope/ (Audit prep and response; ISO 27001, ISO 42001, GDPR, NIS 2, DORA)
- internal-audit-programme-planning: https://grcskills.com/skill/internal-audit-programme-planning/ (Audit prep and response; ISO 27001, ISO 27701, ISO 42001, SOC 2)
- logging-and-monitoring-evidence-pack: https://grcskills.com/skill/logging-and-monitoring-evidence-pack/ (Evidence; ISO 27001, SOC 2, NIS 2)
- management-review-pack: https://grcskills.com/skill/management-review-pack/ (Audit prep and response; ISO 27001, ISO 27701, ISO 42001)
- multi-framework-overlap-map: https://grcskills.com/skill/multi-framework-overlap-map/ (Gap and readiness; General, ISO 27001, SOC 2, NIS 2, NIST CSF, GDPR)
- nis2-entity-applicability-check: https://grcskills.com/skill/nis2-entity-applicability-check/ (Gap and readiness; NIS 2)
- nonconformity-root-cause-and-corrective-action: https://grcskills.com/skill/nonconformity-root-cause-and-corrective-action/ (Audit prep and response; ISO 27001, ISO 27701, ISO 42001, SOC 2, General)
- policy-gap-review-against-practice: https://grcskills.com/skill/policy-gap-review-against-practice/ (Policies and documentation; General, ISO 27001, SOC 2)
- policy-review-cycle-refresh: https://grcskills.com/skill/policy-review-cycle-refresh/ (Policies and documentation; General, ISO 27001, SOC 2)
- post-incident-review: https://grcskills.com/skill/post-incident-review/ (Incidents and continuity; General, ISO 27001, SOC 2)
- privacy-and-ai-control-applicability: https://grcskills.com/skill/privacy-and-ai-control-applicability/ (Statement of applicability; ISO 27701, ISO 42001)
- privacy-notice-gap-check: https://grcskills.com/skill/privacy-notice-gap-check/ (Privacy; GDPR)
- ropa-first-draft: https://grcskills.com/skill/ropa-first-draft/ (Privacy; GDPR, ISO 27701)
- regulatory-incident-reporting-clock: https://grcskills.com/skill/regulatory-incident-reporting-clock/ (Incidents and continuity; NIS 2, DORA, GDPR, HIPAA)
- risk-acceptance-memo: https://grcskills.com/skill/risk-acceptance-memo/ (Risk; General, ISO 27001, DORA)
- risk-method-drafting: https://grcskills.com/skill/risk-method-drafting/ (Risk; ISO 27001, ISO 27701, ISO 42001, DORA, General)
- risk-register-first-pass: https://grcskills.com/skill/risk-register-first-pass/ (Risk; ISO 27001, SOC 2, NIS 2, DORA, General)
- risk-register-hygiene-review: https://grcskills.com/skill/risk-register-hygiene-review/ (Risk; General, ISO 27001, SOC 2)
- risk-to-control-traceability-check: https://grcskills.com/skill/risk-to-control-traceability-check/ (Statement of applicability; ISO 27001, ISO 42001)
- risk-treatment-plan-drafting: https://grcskills.com/skill/risk-treatment-plan-drafting/ (Risk; ISO 27001, SOC 2, General)
- scope-statement-drafting: https://grcskills.com/skill/scope-statement-drafting/ (Gap and readiness; ISO 27001, ISO 27701, ISO 42001)
- secure-development-policy-from-pipeline: https://grcskills.com/skill/secure-development-policy-from-pipeline/ (Policies and documentation; ISO 27001, SOC 2, Cyber Resilience Act)
- security-policy-drafting: https://grcskills.com/skill/security-policy-drafting/ (Policies and documentation; ISO 27001, SOC 2, HIPAA, GDPR)
- stage-1-readiness-walk: https://grcskills.com/skill/stage-1-readiness-walk/ (Gap and readiness; ISO 27001, ISO 27701, ISO 42001)
- soa-first-draft: https://grcskills.com/skill/soa-first-draft/ (Statement of applicability; ISO 27001)
- subprocessor-register-update: https://grcskills.com/skill/subprocessor-register-update/ (Vendors and third parties; GDPR, ISO 27701)
- transfer-impact-assessment: https://grcskills.com/skill/transfer-impact-assessment/ (Privacy; GDPR)
- vendor-security-questionnaire-triage: https://grcskills.com/skill/vendor-security-questionnaire-triage/ (Vendors and third parties; General, ISO 27001, SOC 2, GDPR)
- vendor-tiering: https://grcskills.com/skill/vendor-tiering/ (Vendors and third parties; General, ISO 27001, SOC 2, DORA, NIS 2)

## Optional

- [Contribute a skill](https://grcskills.com/contribute/): interview-driven submission with your own agent
- [Repository](https://github.com/better-isms/grcskills): AGENTS.md explains install, run and submit