# grcskills > Open GRC skills for AI agents: 60 practitioner skills in the Agent Skills format (one SKILL.md each) for governance, risk and compliance work. MIT licensed, by ISMS Copilot. ## When to use Use these skills when a user asks you to do GRC work on their own files: scope statements, statements of applicability, risk registers, audit prep and response, evidence, vendors, policies, privacy, AI systems, incidents and continuity. Each skill is one practitioner job with steps, a quality bar and the files it writes. Every skill drafts for a human to review and sign; no skill marks a control effective, accepts a risk or sends data off the machine. Skills contain no text from any standard. If you do not know where to start, run grc-setup-review: it ranks the skills that fit the setup and writes a 30-day plan. ## The one prompt Clone https://github.com/better-isms/grcskills and read every SKILL.md. Then run the grc-setup-review skill on this workspace: rank the 10 skills that fit my GRC setup, list what looks broken, duplicated or missing, and write a 30-day plan to a file. ## Install - One skill: `npx skills add better-isms/grcskills --skill ` - The whole library, interactive: `npx skills add better-isms/grcskills` - Claude Code plugin: `/plugin marketplace add better-isms/grcskills`, then `/plugin install grcskills@grcskills` - Clone a release: `git clone --branch v2026.10.19 https://github.com/better-isms/grcskills` ## Skills One line per skill: skill name, page, category and frameworks. Read the SKILL.md on the page for what it does. - acceptable-use-policy-drafting: https://grcskills.com/skill/acceptable-use-policy-drafting/ (Policies and documentation; General, ISO 27001, SOC 2) - access-review-campaign-prep: https://grcskills.com/skill/access-review-campaign-prep/ (Evidence; ISO 27001, SOC 2, HIPAA, PCI DSS) - ai-acceptable-use-rules: https://grcskills.com/skill/ai-acceptable-use-rules/ (AI systems; General, ISO 42001, EU AI Act) - ai-act-risk-classification: https://grcskills.com/skill/ai-act-risk-classification/ (AI systems; EU AI Act) - ai-impact-assessment: https://grcskills.com/skill/ai-impact-assessment/ (AI systems; ISO 42001, EU AI Act) - ai-management-system-scope: https://grcskills.com/skill/ai-management-system-scope/ (AI systems; ISO 42001) - ai-system-inventory: https://grcskills.com/skill/ai-system-inventory/ (AI systems; EU AI Act, ISO 42001) - ai-vendor-due-diligence: https://grcskills.com/skill/ai-vendor-due-diligence/ (AI systems; ISO 42001, GDPR, EU AI Act) - soa-status-reconciliation: https://grcskills.com/skill/soa-status-reconciliation/ (Statement of applicability; ISO 27001) - auditor-interview-prep: https://grcskills.com/skill/auditor-interview-prep/ (Audit prep and response; ISO 27001, SOC 2, General) - auditor-sample-preparation: https://grcskills.com/skill/auditor-sample-preparation/ (Audit prep and response; ISO 27001, SOC 2, PCI DSS) - backup-restore-test-evidence: https://grcskills.com/skill/backup-restore-test-evidence/ (Evidence; ISO 27001, SOC 2, DORA, HIPAA) - business-impact-analysis: https://grcskills.com/skill/business-impact-analysis/ (Incidents and continuity; ISO 27001, DORA, NIS 2, General) - change-management-evidence-sampling: https://grcskills.com/skill/change-management-evidence-sampling/ (Evidence; SOC 2, ISO 27001) - bcp-tabletop-design: https://grcskills.com/skill/bcp-tabletop-design/ (Incidents and continuity; ISO 27001, SOC 2, DORA, NIS 2) - control-owner-raci: https://grcskills.com/skill/control-owner-raci/ (Statement of applicability; ISO 27001, SOC 2, General) - customer-security-questionnaire-answers: https://grcskills.com/skill/customer-security-questionnaire-answers/ (Vendors and third parties; General, SOC 2, ISO 27001, GDPR) - dpa-security-annex-review: https://grcskills.com/skill/dpa-security-annex-review/ (Vendors and third parties; GDPR) - data-subject-request-procedure: https://grcskills.com/skill/data-subject-request-procedure/ (Privacy; GDPR, ISO 27701) - document-consistency-check: https://grcskills.com/skill/document-consistency-check/ (Policies and documentation; General) - dpia-screening: https://grcskills.com/skill/dpia-screening/ (Privacy; GDPR, ISO 27701) - evidence-freshness-check: https://grcskills.com/skill/evidence-freshness-check/ (Evidence; General, ISO 27001, SOC 2) - evidence-request-list-builder: https://grcskills.com/skill/evidence-request-list-builder/ (Evidence; ISO 27001, SOC 2, NIS 2, DORA) - soa-exclusion-justification-review: https://grcskills.com/skill/soa-exclusion-justification-review/ (Statement of applicability; ISO 27001, ISO 27701, ISO 42001) - first-gap-assessment: https://grcskills.com/skill/first-gap-assessment/ (Gap and readiness; General, ISO 27001, SOC 2, HIPAA, NIS 2, ISO 42001) - grc-setup-review: https://grcskills.com/skill/grc-setup-review/ (Gap and readiness; General, ISO 27001, SOC 2, GDPR, NIS 2, DORA, ISO 42001, EU AI Act) - phi-flow-mapping: https://grcskills.com/skill/phi-flow-mapping/ (Privacy; HIPAA) - ict-risk-framework-check: https://grcskills.com/skill/ict-risk-framework-check/ (Risk; DORA) - ict-third-party-register: https://grcskills.com/skill/ict-third-party-register/ (Vendors and third parties; DORA) - incident-response-plan-drafting: https://grcskills.com/skill/incident-response-plan-drafting/ (Incidents and continuity; ISO 27001, SOC 2, HIPAA, NIS 2) - incident-severity-triage: https://grcskills.com/skill/incident-severity-triage/ (Incidents and continuity; General, ISO 27001, SOC 2, NIS 2, DORA) - internal-audit-checklist-from-scope: https://grcskills.com/skill/internal-audit-checklist-from-scope/ (Audit prep and response; ISO 27001, ISO 42001, GDPR, NIS 2, DORA) - internal-audit-programme-planning: https://grcskills.com/skill/internal-audit-programme-planning/ (Audit prep and response; ISO 27001, ISO 27701, ISO 42001, SOC 2) - logging-and-monitoring-evidence-pack: https://grcskills.com/skill/logging-and-monitoring-evidence-pack/ (Evidence; ISO 27001, SOC 2, NIS 2) - management-review-pack: https://grcskills.com/skill/management-review-pack/ (Audit prep and response; ISO 27001, ISO 27701, ISO 42001) - multi-framework-overlap-map: https://grcskills.com/skill/multi-framework-overlap-map/ (Gap and readiness; General, ISO 27001, SOC 2, NIS 2, NIST CSF, GDPR) - nis2-entity-applicability-check: https://grcskills.com/skill/nis2-entity-applicability-check/ (Gap and readiness; NIS 2) - nonconformity-root-cause-and-corrective-action: https://grcskills.com/skill/nonconformity-root-cause-and-corrective-action/ (Audit prep and response; ISO 27001, ISO 27701, ISO 42001, SOC 2, General) - policy-gap-review-against-practice: https://grcskills.com/skill/policy-gap-review-against-practice/ (Policies and documentation; General, ISO 27001, SOC 2) - policy-review-cycle-refresh: https://grcskills.com/skill/policy-review-cycle-refresh/ (Policies and documentation; General, ISO 27001, SOC 2) - post-incident-review: https://grcskills.com/skill/post-incident-review/ (Incidents and continuity; General, ISO 27001, SOC 2) - privacy-and-ai-control-applicability: https://grcskills.com/skill/privacy-and-ai-control-applicability/ (Statement of applicability; ISO 27701, ISO 42001) - privacy-notice-gap-check: https://grcskills.com/skill/privacy-notice-gap-check/ (Privacy; GDPR) - ropa-first-draft: https://grcskills.com/skill/ropa-first-draft/ (Privacy; GDPR, ISO 27701) - regulatory-incident-reporting-clock: https://grcskills.com/skill/regulatory-incident-reporting-clock/ (Incidents and continuity; NIS 2, DORA, GDPR, HIPAA) - risk-acceptance-memo: https://grcskills.com/skill/risk-acceptance-memo/ (Risk; General, ISO 27001, DORA) - risk-method-drafting: https://grcskills.com/skill/risk-method-drafting/ (Risk; ISO 27001, ISO 27701, ISO 42001, DORA, General) - risk-register-first-pass: https://grcskills.com/skill/risk-register-first-pass/ (Risk; ISO 27001, SOC 2, NIS 2, DORA, General) - risk-register-hygiene-review: https://grcskills.com/skill/risk-register-hygiene-review/ (Risk; General, ISO 27001, SOC 2) - risk-to-control-traceability-check: https://grcskills.com/skill/risk-to-control-traceability-check/ (Statement of applicability; ISO 27001, ISO 42001) - risk-treatment-plan-drafting: https://grcskills.com/skill/risk-treatment-plan-drafting/ (Risk; ISO 27001, SOC 2, General) - scope-statement-drafting: https://grcskills.com/skill/scope-statement-drafting/ (Gap and readiness; ISO 27001, ISO 27701, ISO 42001) - secure-development-policy-from-pipeline: https://grcskills.com/skill/secure-development-policy-from-pipeline/ (Policies and documentation; ISO 27001, SOC 2, Cyber Resilience Act) - security-policy-drafting: https://grcskills.com/skill/security-policy-drafting/ (Policies and documentation; ISO 27001, SOC 2, HIPAA, GDPR) - stage-1-readiness-walk: https://grcskills.com/skill/stage-1-readiness-walk/ (Gap and readiness; ISO 27001, ISO 27701, ISO 42001) - soa-first-draft: https://grcskills.com/skill/soa-first-draft/ (Statement of applicability; ISO 27001) - subprocessor-register-update: https://grcskills.com/skill/subprocessor-register-update/ (Vendors and third parties; GDPR, ISO 27701) - transfer-impact-assessment: https://grcskills.com/skill/transfer-impact-assessment/ (Privacy; GDPR) - vendor-security-questionnaire-triage: https://grcskills.com/skill/vendor-security-questionnaire-triage/ (Vendors and third parties; General, ISO 27001, SOC 2, GDPR) - vendor-tiering: https://grcskills.com/skill/vendor-tiering/ (Vendors and third parties; General, ISO 27001, SOC 2, DORA, NIS 2) ## Optional - [Contribute a skill](https://grcskills.com/contribute/): interview-driven submission with your own agent - [Repository](https://github.com/better-isms/grcskills): AGENTS.md explains install, run and submit