GRCLibrary.ai

Document type

Registers

40 documents: 39 in the corpus and 1 adopter document under docs/. Living inventories of record: assets, risks, controls, and decisions.

Documents, 40

Every document of this type

Each with its area and its purpose; a document that states no purpose gets a line naming its type and area. A title in a corpus area opens the document's page, which holds the record and, where the document has them, its outline, frameworks, and related documents; a title in the Library area is a library specification with no page and opens its source on GitHub. The full text of every document is read on GitHub.

  • AI Risk RegisterAIThis register defines the schema, governance, and representative risk entries for the AI Risk Register. The AI Risk Register is the central record of identified risks associated with AI systems deployed or under development by the organization. It supports the AI Governance Council's risk oversight function and feeds into the enterprise risk management process.
  • Model Context Protocol Server RegisterAIThis register inventories Model Context Protocol (MCP) servers the organization operates internally, consumes from third parties, or permits AI assistants to invoke. MCP is the canonical pattern for exposing tools, data sources, and capabilities to AI agents; each MCP server is a security boundary that must be governed, monitored, and reviewed.
  • Model RegistryAIThis register is the model-scoped view of the AI System Inventory, the authoritative system-of-record for all AI models and systems maintained per ai/procedure-ai-model-lifecycle-management.md; it covers every model used in production or pre-production by the organization. A model is any artefact whose outputs are consumed by the organization's products, services, internal operations, or AI systems. The register complements the AI System Register (the system-scoped view of the same inventory, listing deployed AI systems and use cases) by capturing per-model technical, ownership, lineage, evaluation, and lifecycle attributes.
  • BASC IT and Information Security ResponsibilitiesComplianceThis register defines the IT and information security roles and responsibilities for compliance with the BASC International Norm and the applicable BASC International Security Standard (6.0.2 or 6.0.3). BASC certification requires documented accountability for security controls. This register maps BASC control domains to responsible parties within IT, identifies the corresponding GRC library documents, and notes where IT ownership ends and operational ownership begins.
  • BASC IT Compliance Monitoring and KPIsComplianceThis register defines the key performance indicators (KPIs) used to monitor IT and cybersecurity obligations under the BASC International Norm V6-2022. BASC Norm §8.1 requires that the organization establish, implement, and maintain monitoring and measurement processes. This register operationalizes that requirement for IT-owned controls. Results are reported to the CISO monthly and to the BASC Compliance function quarterly.
  • Canada PIP IT and Cybersecurity Compliance Controls RegisterComplianceThis register documents the organization's IT and cybersecurity controls and maps them to the cybersecurity expectations of Canada's Partners in Protection (PIP) programme administered by the Canada Border Services Agency (CBSA). It supports PIP membership, the annual security-profile update in the CBSA Trusted Trader Portal, and application readiness.
  • Compliance Obligations Register TemplateComplianceThis template defines the structure, schema, and population guidance for an organization's Compliance Obligations Register. The register provides a single consolidated inventory of all applicable legal, regulatory, contractual, and voluntary obligations, enabling the organization to track compliance status, assign ownership, and prioritize remediation.
  • Global Regulatory Applicability RegisterComplianceThis register provides an organization-neutral structure for identifying regulatory applicability. It does not state that any specific law applies to an adopting organization. Applicability depends on facts including jurisdiction, establishment, data residency, processing role, sector, customer commitments, regulated activity, data category, and service model.
  • US CTPAT IT and Cybersecurity Compliance Controls RegisterComplianceThis register documents the organization's implementation status against the IT and cybersecurity-related minimum security criteria of the U.S. Customs-Trade Partnership Against Terrorism (CTPAT) programme. It supports CTPAT membership compliance, annual trade partner profile updates, and pre-certification readiness assessments.
  • US CTPAT Minimum Security Criteria Controls RegisterComplianceThis register documents the organization's implementation status against the CTPAT Minimum Security Criteria, grouped in this register's eight domains: corporate security, physical security, access controls, personnel security, procedural security (cargo handling), business partner security, information technology, and conveyance and cargo unit security. The library holds no complete CBP criteria text (its only held CBP CTPAT source is a cybersecurity checklist job aid, which reflects only the cybersecurity criteria), so each CTPAT Criterion cell is the library's own summary, unverified against CBP wording, and coverage of every criterion CBP applies to the organization's entity type is not confirmed. It complements compliance/logistics/register-ctpat-united-states-it-controls.md, which focuses specifically on IT and cybersecurity criteria.
  • Crypto-Asset Domain Inventory RegisterCryptoThis register is the authoritative, organization-neutral record of the crypto-assets the organization holds, the wallets, accounts, and custody arrangements through which they are controlled, the blockchain platforms in use, and the smart contracts it has deployed. It is the domain inventory that the Crypto-Asset Governance Framework mandates as Governance requirement 4, and against which the Digital Asset Custody Standard reconciles. It records the RESULT of the framework's classification and approval controls; it does not restate the rules that produce those results.
  • Compliance Controls and Gap Register TemplateDev securityThis register is the primary traceability artefact for audit, insurance, board reporting, and regulatory purposes. It maps security and compliance controls to CSA CCM v4.1, AICM v1.1, and COBIT 2019 process identifiers, and records implementation status, evidence type, and responsible party for each control.
  • AI Security Tooling Landscape RegisterGovernanceThis register documents the AI security tooling landscape originally surveyed in Wave 1 and Wave 2 of the external-project assessment that informed Phases 23.1 through 23.6 of the library, with subsequent additions and provenance-block enrichment through Phase 23.10 and beyond. It records, for each project: scope, license, library reference status, key capabilities, and the GRC concern or gap each project surfaced for the library's content.
  • Canonical Citations RegisterGovernanceThis register is the positive list of canonical citations used across the GRC Documentation Library.
  • Coverage Gap Analysis RegisterGovernanceThis register is the library's honest disclosure of what it does not yet cover. It exists so that adopting organizations can determine whether the library addresses their domain, sector, jurisdiction, or regulatory regime before they invest in adoption, and so contributors know where additions would have the most impact.
  • Data Retention ScheduleGovernanceThis register defines the mandatory retention periods for each category of organizational data and records. It implements the Records Retention and Destruction Standard and supports the organization's compliance with applicable privacy laws (GDPR, PIPEDA, Quebec Law 25, UK GDPR, LGPD, PIPL), regulatory requirements, and contractual obligations.
  • Digital Trust and Assurance Metrics RegisterGovernanceThis register defines reusable metric categories for evaluating governance maturity, control coverage, resilience, data protection, supplier assurance, and artificial intelligence governance. Metrics are original, organization-neutral, and do not reproduce restricted third-party metrics catalogues.
  • Document Index and Classification RegisterGovernanceThis register is the authoritative index for active documents in the public GRC Documentation Library. It records, per active document, its domain, type, title, repository path, owner role, review frequency, primary alignment families, and adoption disposition. For Owner Role and Review Frequency, each document's own metadata header is the go-forward source of truth and this register is maintained as a mirror of it: the index records the base Review Frequency cadence (a document header may add a trigger clause on top of the same base cadence) and the Owner Role. A base-cadence or owner-role disagreement between the two is reconciled toward the header; a mechanical index-header parity audit (gate 92, tools/lint-index-header-parity.py) enforces this.
  • Glossary and Acronym IndexGovernanceThis register resolves the acronyms and external-domain terms used throughout the GRC Documentation Library, primarily standards, regulations, frameworks, regulators, sector programmes, and well-known technical concepts. Where a term has a primary canonical document in the library, that document is cited.
  • Key Terms and Definitions RegisterGovernanceThis register defines library-internal GRC concepts used across the GRC Documentation Library: terms whose specific meaning within the library's governance vocabulary differs from generic usage and that anchor how the library writes about governance, risk, and compliance. Definitions are written for organization-neutral reuse and do not incorporate restricted wording from external standards or framework materials.
  • Role Authority RegisterGovernanceThis register defines generic governance roles used across the GRC Documentation Library. Roles are deliberately organization-neutral and must not be replaced with named individuals in the public repository. Most rows describe roles in an adopting organization's governance structure; a small number of *Maintainer and library-meta rows (for example the Governance Library Maintainer) instead describe the roles that maintain this reference corpus itself, and say so explicitly in their accountability cell.
  • Asset Inventory RegisterOperationsThis register defines the schema, governance, and classification model for the organizational Asset Inventory. The Asset Inventory is the authoritative record of all IT hardware, software, cloud resources, data assets, and AI systems owned, managed, or used by the organization as IT assets. For AI systems, the Asset Inventory records them as deployed IT assets and defers to the AI System Inventory (the authoritative AI-governance record of all AI models and systems, owned by the AI System Inventory Keeper) for their AI-governance attributes such as model lineage, organizational AI risk classification, and lifecycle status. It supports risk assessments, vulnerability management, disaster recovery planning, and compliance activities.
  • IT Operations Key Performance Indicators RegisterOperationsThis register defines the key performance indicators (KPIs) used to measure IT operations effectiveness across availability, incident management, change management, problem management, patch and vulnerability management, capacity, service desk, and security operations. KPIs support governance reporting to the CIO and Enterprise Risk Committee (ERC) and align with ISO/IEC 20000-1:2018, ITIL 4, COBIT 2019, and EU NIS 2 Directive obligations.
  • IT Security Operations RegisterOperationsThis register defines the schema, governance model, and section structure for the IT Security Operations Register. The register is the single authoritative source for current operational security state across all IT platforms and environments. It does not contain security requirements: those are defined in security policies and standards. This register records the current implementation state and tracks remediation of identified gaps.
  • OT Asset Inventory and Lifecycle RegisterOperationsThis register defines the schema, governance, classification, and lifecycle model for the organization's Operational Technology (OT) asset inventory. The OT asset inventory is the authoritative record of all OT hardware, firmware, software, network components, and supporting infrastructure within scope of the OT/ICS Security Standard (operations/ot/standard-ot-ics-security.md).
  • Automated Decision-Making and Profiling RegisterPrivacyThis register inventories automated decision-making and profiling activities subject to EU GDPR Article 22, UK GDPR Articles 22A-22D (per the UK annex; DUAA 2025 replaced Article 22, in force 2026-02-05), EU AI Act Articles 6 and 14, LGPD Article 20, PIPL Article 24, CPPA Section 63(3) (lapsed with Bill C-27), CCPA / CPRA automated decision-making rules, and equivalent provisions. It supports the transparency, human-review, and explanation rights data subjects can exercise. Under LGPD Article 20, the data subject has the right to request review of decisions taken solely on the basis of automated processing of personal data that affect their interests; the human review this register offers (item 2 under Subject rights and operating expectations) is the organization's own control and applies whether or not the governing regime requires review by a natural person.
  • Cookie and Tracker RegisterPrivacyThis register inventories cookies, similar storage technologies, and tracking technologies operated on the organization's websites, mobile applications, embedded surfaces, and partner-integrated channels. It supports the consent management framework, the privacy notice, and the ePrivacy and equivalent obligations across the EU, UK, and other jurisdictions with prior-consent or opt-in requirements for non-essential tracking. For Brazil, Article 7 IX of the Marco Civil da Internet (Lei 12.965/2014) gives internet users a right ("ao usuário são assegurados") of express consent regarding the collection, use, storage and processing of personal data ("consentimento expresso sobre coleta, uso, armazenamento e tratamento de dados pessoais"), and that consent must be set apart from the other contract clauses ("que deverá ocorrer de forma destacada das demais cláusulas contratuais"); neither that law nor the LGPD mentions cookies, and LGPD Article 7 provides that the processing of personal data may only be carried out in the cases ("hipóteses") it lists, one of which is upon the provision of consent by the data subject, and Article 8 sets requirements for that consent and provides that it may be revoked at any time by express manifestation of the data subject ("mediante manifestação expressa do titular"). Separately, the ANPD's guidance on cookies (the "guia orientativo" listed under Framework alignment) states that, although there is no hierarchy or preference among the legal bases ("hipóteses legais") provided for in the LGPD, recourse to consent will be more appropriate when the collection of information is carried out by cookies that are not necessary ("cookies não necessários"), and that the use of cookies for audience measurement (analytical or measurement cookies) may be grounded in the legal basis of legitimate interest in certain contexts, subject in any case to the requirements provided for in the LGPD. In particular, the guide states that it is reasonable to suppose that the risks to the privacy of data subjects will be lower when the processing is limited to the specific purpose of identifying patterns and trends, based on aggregated data and without combination with other tracking mechanisms or without the formation of user profiles.
  • Cross-Border Data Flow RegisterPrivacyThis register documents all cross-border transfers of personal data from the organization's operating jurisdictions to third countries. It provides the basis for demonstrating compliance with Chapter V of the GDPR, Chapter V of the UK GDPR, and equivalent requirements under applicable privacy laws in Canada (PIPEDA), Quebec (Law 25), Brazil (LGPD), China (PIPL), and other applicable regimes.
  • Emergency Operations Contact Directory RegisterResilienceThis template defines a reusable structure for maintaining emergency operations contact information. It must not be populated with real names, phone numbers, email addresses, locations, suppliers, regulators, or internal escalation details in this public repository.
  • Resilience Metrics and Testing Log RegisterResilienceThis template provides a reusable structure for recording resilience metrics, continuity tests, recovery tests, crisis exercises, corrective actions, and residual risk decisions.
  • Resilience Terms and Definitions RegisterResilienceThis register defines resilience terminology used across the public GRC Documentation Library. Definitions are original, organization-neutral, and intended for CC BY-SA 4.0 reuse.
  • Assurance Map RegisterRiskThis register records, for each material risk, what assurance is in place and where the gaps are. It applies the three-lines model (and where adopted, the IIA's Three Lines Model 2020 update) by mapping risks against the activities of the first, second, and third lines of defence and against external assurance.
  • Key Risk Indicator CatalogueRiskThis catalogue defines Key Risk Indicators (KRIs) for monitoring enterprise risk across all risk categories. KRIs provide early warning signals that a risk is increasing or that an existing control is degrading. They supplement reactive incident reporting with proactive threshold monitoring.
  • Scenario Risk CatalogueRiskThis catalogue lists scenarios used for scenario-based risk analysis, stress testing, tabletop exercises, business-continuity testing, and resilience assurance. Each scenario is a plausible adverse event that exercises the organization's controls, response, and recovery posture.
  • Approved Key-Agreement Protocols RegisterSecurityThis register lists the protocols that may be approved protocols, within which the ephemeral key-agreement key exemptions in the Cryptographic Key Operations Procedure and the Cryptographic Key Lifecycle Management Framework apply. A protocol is an approved protocol only when it is listed here and the adopting organization's Security Architecture has recorded the date and reference of its approval in the protocol's row; until then the exemptions do not apply to it. For each protocol, the register also records the one-time CISO approval that the procedure, section 4.3, requires before the protocol is used for ephemeral key-agreement keys on a high-sensitivity system. The register records these approvals; it does not restate the rules for ephemeral key-agreement keys, which the procedure holds.
  • Concentration Risk RegisterSupply chainThis register records the concentration of supplier dependencies across the supplier portfolio. It identifies single points of failure, shared dependencies, geographical clusters, and regulatory or geopolitical concentrations that would cause cross-portfolio impact if a concentrated dependency fails. For DORA, it supplies connected-provider and single-supplier concentration indicators as an input to the financial entity's Article 29(1) consideration, which the entity performs outside the register, and, where a concentration subject is a designated critical ICT third-party provider, it records a link to that designation, without applying the designation criteria; it also supports the broader supplier risk programme.
  • Software Bill of Materials RegisterSupply chainThis register tracks Software Bill of Materials (SBOM) artefacts for the organization's internally-built software, for purchased commercial software, and for open-source dependencies in use. The register is the navigation layer over an SBOM repository; the actual SBOM artefacts (CycloneDX, SPDX) are stored as machine-readable files referenced by the register.
  • Subprocessor Register TemplateSupply chainThis template defines the schema for the organization's Subprocessor Register. The register records all third-party organizations that process personal data on behalf of the organization as data processors or subprocessors. It supports GDPR Article 28 compliance, enables transparency with data subjects and supervisory authorities, and provides the basis for subprocessor notifications to customers where contractually required.
  • Supplier Risk Register TemplateSupply chainThis template defines the schema for the organization's Supplier Risk Register: the operational record of all active supplier relationships, their risk classifications, assurance status, monitoring history, and contract details. It serves as the single source of truth for supplier governance and feeds into the enterprise risk register for Tier 1 and High-rated Tier 2 risks.

Adopter documents, 1

The 1 adopter document of this type, under docs/ and outside the corpus taxonomy; its entry is read from the leading metadata block of its file at build time. Its title opens the document's page, which holds the record and, where the document has them, its outline and related documents.

  • Document Maturity ScorecardAdopter documentsThe maturity scorecard classifies each active artefact as Mature, Baseline, or Draft. The classification is derived from the document's semantic version by the heuristic recorded in the scorecard.

With script, All Documents, filtered to Registers, lists the 39 of this page's 40 documents that sit in a corpus area, and the area chips holding any of them, and its text filter, narrow them further.