GRCLibrary.ai

Document type

Frameworks

26 documents. Organizing structures that arrange controls, functions, and lifecycles.

Documents, 26

Every document of this type

Each with its area and its purpose; a document that states no purpose gets a line naming its type and area. A title in a corpus area opens the document's page, which holds the record and, where the document has them, its outline, frameworks, and related documents; a title in the Library area is a library specification with no page and opens its source on GitHub. The full text of every document is read on GitHub.

  • Agentic Response State Model FrameworkAIThis framework defines a state model for automated (agentic) response to a detected condition (a security event, an operational anomaly, a policy breach). The corpus governs the human incident lifecycle (ai/plan-ai-incident-response.md) and requires human review before containment (operations/procedure-threat-intelligence-and-siem-operations.md), but it has no state machine for what an agent may do autonomously between detection and human authorization. This framework supplies that: the states an agentic response moves through, the transitions between them, and, at each transition, the containment-authority boundary that separates what the agent may do within its existing observation-and-analysis grant from what requires a further human grant.
  • AI Assurance Evidence and Attestation FrameworkAIThis framework defines the assurance-evidence and attestation model for AI systems: the claim taxonomy, evidence classes, attestation tiers, and sufficiency criteria by which the organization organizes the outputs of its existing assurance activities into a standing, audit-ready evidence base across the AI lifecycle. Its object is the evidence, not the activity that produces it: it indexes, grades, and marshals what the assurance activities already generate so that any assurance claim about an AI system can be traced to the artefacts that support it, at a known weight and currency, on demand.
  • AI Governance and Risk FrameworkAIThis framework defines a reusable governance model for artificial intelligence systems. It addresses accountability, lifecycle control, risk classification, data governance, security, human oversight, supplier dependency, monitoring, assurance, and retirement.
  • AI Maturity Model FrameworkAIThis framework defines a domain-specific maturity instrument for an organization's AI governance and security. It gives the AI Governance Council the backing instrument for the "AI maturity KPI" recorded in its charter, and it provides the AI-domain view of programme maturity that feeds the organization's governance performance reporting.
  • AI Model Documentation and Transparency FrameworkAIThis framework defines the documentation and transparency requirements for all AI systems deployed or developed by the organization. It establishes minimum standards for model cards, AI Impact Assessments, training data records, and transparency disclosures, ensuring that AI systems are understandable, auditable, and accountable to stakeholders, regulators, and affected individuals.
  • AI Model Risk FrameworkAIThis framework defines an organization-neutral model for identifying, assessing, treating, monitoring, and evidencing risks arising from AI model behaviour, data representation, robustness, interpretability, lifecycle control, and deployment context.
  • AI System Audit and Certification FrameworkAIThis framework defines the audit and certification approach for AI systems within the organization. It establishes the audit programme structure, evidence requirements, audit frequency by audit tier, the certification pathway to ISO/IEC 42001:2023, post-market monitoring obligations, conformity assessment requirements for EU AI Act high-risk systems, and the integration of audit findings into the corrective and preventive action (CAPA) process.
  • AI Value and Decision-Governance FrameworkAIThis framework treats the value an organization pursues from AI, and the quality of the decisions by which it pursues it, as governance evidence. Where ai/framework-ai-governance-and-risk.md governs accountability, lifecycle, and risk, and ai/framework-ai-maturity-model.md assesses process-and-capability maturity against the corpus's CMMI ladder, this framework governs the value and decision axis: whether an AI initiative's intended value is stated and tracked, whether the decision to pursue it was made with the evidence a governing body would expect, and whether the realized benefits are classified honestly. These are governance constructs (signals and evidence a reviewer can inspect), not normative external requirements.
  • Enterprise Architecture FrameworkArchitectureThis framework defines the enterprise architecture practice: its principles, scope, viewpoints, deliverables, governance forum, and integration with adjacent governance programmes. It expresses outcomes and operating expectations, not a specific toolchain or notation.
  • Crypto-Asset Governance FrameworkCryptoThis framework is the governance anchor for the crypto-asset and blockchain domain. It sets the organization-neutral control model for holding, using, issuing, or servicing crypto-assets and for adopting distributed-ledger (blockchain) technology, so that crypto-asset activity is classified, approved, inventoried, and risk-managed before it begins rather than after an incident.
  • Continuous Assurance and Improvement FrameworkGovernanceThis framework defines the enterprise-wide structure, responsibilities, and processes for maintaining continuous governance assurance, audit readiness, and performance improvement across all business and technology domains.
  • Document Architecture and Interrelationship FrameworkGovernanceThis framework defines how documents in the GRC Documentation Library relate to each other. It establishes a hierarchy that connects governance authority to policies, standards, procedures, plans, evidence, metrics, and cross-framework mappings.
  • Governance Performance and Improvement FrameworkGovernanceThis framework defines the processes and performance mechanisms used to measure, review, and continually improve the organization's governance, risk, compliance, and digital trust programmes. It consolidates the performance measurement model, governance review process, maturity assessment methodology, and continuous improvement cycle into a single enterprise governance improvement model.
  • Governance Relationship and Flow Modelling FrameworkGovernanceThis framework standardizes how governance, risk, and compliance entities are modelled as directed relationships. It defines a relationship grammar, a node-class taxonomy, a controlled verb vocabulary, a set of declared viewpoints, direction and placement rules, and a validation method, so that a relationship asserted anywhere in this library, or in an adopting organization's own registers and matrices, is precise, directional, testable, and free of the ambiguity that vague linkage language such as relates to produces.
  • Human Capital and Ethical Conduct FrameworkGovernanceThis framework defines the organization's approach to ethical conduct, workforce integrity, and responsible innovation. It integrates human resource governance, ethical behaviour standards, and professional conduct expectations for all employees and affiliates.
  • Metrics, Monitoring and Performance Reporting FrameworkGovernanceThis framework defines the governance metrics, Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and performance reporting structures that support measurement, monitoring, and continual improvement across enterprise GRC domains. It establishes standardized performance measurement across cybersecurity, privacy, AI, and supply-chain operations including BASC trade and customs compliance.
  • Sustainability and Responsible Technology FrameworkGovernanceThis framework defines the organization's approach to environmental sustainability, ethical technology development, and human rights due diligence across all operations and digital systems. It consolidates the Sustainability Framework, Ethical Technology Use Framework, and Human Rights Due Diligence Framework into a unified enterprise structure.
  • IT Service Management FrameworkOperationsThis framework defines the structure, principles, and processes of the organization's IT Service Management (ITSM) function. It consolidates all ITIL-based processes, Incident, Problem, Change, Release, Request, Capacity, Availability, and Service Level Management, into a unified governance model. It aligns with ISO/IEC 20000-1:2018, ITIL 4, COBIT 2019 DSS02 and DSS03, and EU NIS 2 Directive requirements.
  • Children's Data FrameworkPrivacyThis framework defines the safeguards that apply when the organization processes personal data of children. It addresses age assurance, parental or guardian consent, special-category treatment of children's data, design defaults, profiling and ADM restrictions, and the special obligations under COPPA, GDPR-K, UK Children's Code (Age Appropriate Design Code), Quebec under-14 rules, AB 1394 and similar US state laws, and equivalents.
  • Consent Management FrameworkPrivacyThis framework defines the operating model for capturing, recording, refreshing, and honouring consent across the organization. It distinguishes consent from other lawful bases, sets the validity standard, identifies the granularity required for different purposes, and defines the audit trail that supports a defensible position with supervisory authorities and data subjects.
  • Privacy by Design FrameworkPrivacyThis framework operationalizes the data protection by design and by default obligation in GDPR Article 25 (Regulation (EU) 2016/679). It does so by mapping the seven foundational principles of privacy by design to the organization's architecture and development-security workflows, so that data-protection measures are built into systems at the design stage rather than retrofitted.
  • Business Continuity and Resilience FrameworkResilienceThis framework defines an organization-neutral model for business continuity, disaster recovery, crisis management, operational resilience, and recovery assurance.
  • Cryptographic Key Lifecycle Management FrameworkSecurityThis framework establishes the strategic governance, lifecycle controls, and operational standards for managing cryptographic keys across the organization's IT, OT, cloud, and BASC-certified trade environments. It defines a unified structure for key generation, distribution, storage, rotation, revocation, and destruction, aligned with NIST SP 800-57 and ISO/IEC 27002:2022 ยง8.24, and applicable to BASC-certified and WCO SAFE trade environments (which prescribe no cryptographic standard of their own).
  • Insider Risk Programme FrameworkSecurityThis framework defines the organization's approach to insider risk: the risk that current or former employees, contractors, or trusted third parties act in ways (intentional or unintentional) that harm the organization. It establishes the programme objectives, the governance model, the detection and response capabilities, the privacy and due-process safeguards, and the coordination with HR, Legal, Privacy, and Internal Audit.
  • Zero Trust Architecture FrameworkSecurityThis framework defines the organization's approach to zero trust architecture (ZTA): the principles, pillars, control patterns, and migration model that bring identity, device, network, application, data, and workload controls into a coherent posture where trust is never implicit. It supports the migration from perimeter-based security to a model in which every request is authenticated, authorized, and continuously evaluated.
  • Supplier and Cloud Governance FrameworkSupply chainThis framework defines an organization-neutral model for supplier, third-party, cloud, managed service, outsourced processing, AI service, and supply-chain governance.

With script, All Documents, filtered to Frameworks, lists these 26 documents, and the area chips holding any of them, and its text filter, narrow them further.