grc-status
Skill2 starsChanged 14 days agoMITView on GitHub
Roll up the GRC workspace (risk register, policies, evidence tracker, readiness assessments, run logs) into a one-page programme status for leadership or the board — progress per framework, top risks, overdue actions, decisions needed, and next 30 days. Use for "GRC status", "compliance update", "board report", "where are we with ISO/SOC 2", "weekly compliance summary", or management review inputs (ISO 9.3).
1 other project uses a version of this, 1 of them edited.
Adopted by
Most recently taken up by
- grcmana/grc-osedited, first seen Nov 8, 2026
Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 1
- grcmana/grc-os★ 299% same
Wrote their own version · 0
None found.
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository11 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- ai-impact-assessmentSkill
- audit-readinessSkill
- company-contextSkill
- cyber-essentials-scopingSkill
- dpiaSkill
- evidence-request-listSkill
- evidence-reviewSkill
- policy-gap-reviewSkill
- policy-writerSkill
- risk-registerSkill
The file
We split this skill into the rules it gives an agent
4 rules. About 0 are common, 4 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈4
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 27
If the workspace is mostly empty, say so plainly and recommend the next skill to run, rather than producing a hollow report.
- Distinctive: line 40
Leave decision and output fields for humans to fill in.
- Distinctive: line 57
Every number must come from workspace files.
- Distinctive: line 62
Don't soften bad news. Leadership needs it early.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
GRC Status
You produce a one-page, decision-oriented status of the GRC programme from what's actually in the grc/ workspace. Leadership needs to know: are we on track, what's at risk, and what do you need from me?
Read references/grc-workspace.md first.
Inputs (read whatever exists)
grc/context/company-profile.md: frameworks, target dates, driversgrc/risks/risk-register.csv: bands, overdue treatments, pending acceptancesgrc/policies/: count by status (draft / approved), overdue reviewsgrc/evidence/evidence-tracker.csv: status counts, overdue items, rejected itemsgrc/audits/readiness-*.md: the latest readiness % per frameworkgrc/runs/: activity since the last status
If the workspace is mostly empty, say so plainly and recommend the next skill to run, rather than producing a hollow report.
Modes
- exec: one page for the CEO, leadership team or board. This is the default.
management-review: structured to cover the ISO 27001 / ISO 42001 9.3 management review inputs:
- status of actions from previous reviews
- changes in external and internal issues
- interested parties' needs
- performance feedback: nonconformities, monitoring results, audit results, objectives
- feedback from interested parties
- risk assessment results and treatment plan status
- opportunities for improvement
Leave decision and output fields for humans to fill in.
- weekly: a short delta since the last status, for the working team.
Exec report structure
- Headline: one sentence on overall RAG and the key message.
- Framework progress: a table of framework · target date · readiness % · RAG · trend.
- Top five risks: residual score, owner, treatment status.
- Overdue and at risk: treatments, evidence, policy approvals.
- Decisions needed: risk acceptances pending, policy approvals, budget and resourcing asks. Be specific: what, by whom, by when.
- Next 30 days: three to five commitments.
Outputs
grc/status-YYYY-MM-DD.md(orgrc/audits/management-review-YYYY-MM-DD.mdin management-review mode)- A brief chat summary
- A run log in
grc/runs/
Guardrails
- Every number must come from workspace files. If data is missing, say "no data", and never estimate.
- RAG must follow a stated rule:
- 🟢: on track for the target date
- 🟠: at risk, recoverable with a stated action
- 🔴: target date not achievable without a decision
- Don't soften bad news. Leadership needs it early.
References
references/grc-workspace.mdreferences/risk-methodology.mdreferences/evidence-standards.md
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.