{"id":84261,"url":"https://github.com/getprobo/awesome-compliance","name":"awesome-compliance","description":"A curated list of tools, frameworks, and resources for IT compliance, security standards, and regulatory requirements","projects_count":87,"last_synced_at":"2026-09-16T12:00:20.420Z","repository":{"id":276403735,"uuid":"929170479","full_name":"getprobo/awesome-compliance","owner":"getprobo","description":"A curated list of tools, frameworks, and resources for IT compliance, security standards, and regulatory requirements","archived":false,"fork":false,"pushed_at":"2026-01-15T23:30:02.000Z","size":129,"stargazers_count":107,"open_issues_count":47,"forks_count":59,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-08-27T17:04:51.866Z","etag":null,"topics":["awesome","awesome-list","compliance","cybersecurity","esg","fedram","gouvernance","grc","iso2700","nist","policy","risk-management","security","soc2"],"latest_commit_sha":null,"homepage":"https://awesome-compliance.com","language":"Astro","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/getprobo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-02-07T23:56:24.000Z","updated_at":"2026-08-25T04:52:04.000Z","dependencies_parsed_at":"2026-01-24T10:04:43.292Z","dependency_job_id":null,"html_url":"https://github.com/getprobo/awesome-compliance","commit_stats":null,"previous_names":["getprobo/awesome-compliance"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/getprobo/awesome-compliance","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getprobo%2Fawesome-compliance","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getprobo%2Fawesome-compliance/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getprobo%2Fawesome-compliance/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getprobo%2Fawesome-compliance/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/getprobo","download_url":"https://codeload.github.com/getprobo/awesome-compliance/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getprobo%2Fawesome-compliance/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37358511,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-16T02:00:06.638Z","response_time":96,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2025-02-08T12:16:49.503Z","updated_at":"2026-09-16T12:00:20.420Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["Frameworks \u0026 standards","Contributing","Other ressources","Tools \u0026 softwares","Related"],"sub_categories":["Security, privacy \u0026 data protection","Content","Government \u0026 risk management","Compliance automation","Financial \u0026 corporate","Quality management","GRC","Security assessment","Risk \u0026 compliance management","ESG \u0026 sustainability","ESG \u0026 sustainability platforms","Community"],"readme":"# Awesome Compliance [![Awesome](https://awesome.re/badge.svg)](https://awesome.re)\n\nA curated list of awesome resources for Governance, Risk Management, and Compliance (GRC) professionals.\n\nThis list is intended for **compliance officers**, **risk managers**, **auditors**, and **cybersecurity professionals** who need trusted resources for **ISO 27001**, **SOC 2**, **SOX**, **ESG**, and more.\n\n## Contents\n\n- [Frameworks \u0026 standards](#frameworks--standards)\n- [Tools \u0026 softwares](#tools--softwares)\n- [Other ressources](#other-ressources)\n\n## Frameworks \u0026 standards\n\n### ESG \u0026 sustainability\n\n- [B Corp Certification](https://www.bcorporation.net/) - B Lab's Impact Assessment (Every three year).\n- [CDP](https://www.cdp.net/) - Carbon Disclosure Project (self-declarative).\n- [GRI Standards](https://www.globalreporting.org/) - Global Reporting Initiative Standards (self-declarative).\n- [ISO 14001](https://www.iso.org/iso-14001-environmental-management.html) - Environmental management (Annual audit).\n- [ISO 45001](https://www.iso.org/iso-45001-occupational-health-and-safety.html) - Occupational health and safety (Annual audit).\n- [ISO 50001](https://www.iso.org/iso-50001-energy-management.html) - Energy management (Annual audit).\n- [SASB Standards](https://www.sasb.org/) - Sustainability Accounting Standards Board framework (self-declarative).\n- [TCFD](https://www.fsb-tcfd.org/) - Task Force on Climate-related Financial Disclosures (self-declarative).\n- [UN SDGs](https://sdgs.un.org/) - United Nations Sustainable Development Goals (self-declarative).\n\n### Financial \u0026 corporate\n\n- [Basel Framework](https://www.bis.org/basel_framework/) - Banking supervision standards (Regular supervisory reviews).\n- [FCRA](https://www.consumerfinance.gov/) - Fair Credit Reporting Act for consumer data accuracy (Annual audit).\n- [IFRS](https://www.ifrs.org/) - International Financial Reporting Standards (Annual audit).\n- [OFDSS](https://www.financialdataexchange.org/) - Open Financial Data Security Standard for fintech (self-declarative).\n- [PCI-DSS](https://www.pcisecuritystandards.org/) - Payment Card Industry Data Security Standard for credit card protection (Annual audit).\n- [SOX ITGC](https://www.sec.gov/spotlight/sarbanes-oxley.htm) - IT General Controls under Sarbanes-Oxley (Annual audit).\n\n### Government \u0026 risk management\n\n- [CPS234](https://www.apra.gov.au/cps-234-information-security) - Australian Prudential Standard for financial information security.\n- [ISO 42001](https://www.iso.org/standard/81278.html) - AI Management System standard.\n- [NIST CSF](https://www.nist.gov/cyberframework) - Cybersecurity Framework for managing risk (self-declarative).\n- [NIST SP 800-171](https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) - Security controls for protecting Controlled Unclassified Information (CUI).\n- [NIST SP 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) - Security \u0026 privacy controls for federal agencies (self-declarative).\n\n### Quality management\n\n- [AS9100](https://www.sae.org/standards/as9100/) - Aerospace quality management (Annual surveillance).\n- [cGMP](https://www.fda.gov/drugs/pharmaceutical-quality-resources/current-good-manufacturing-practice-cgmp-regulations) - FDA inspections required.\n- [ISO 9001](https://www.iso.org/iso-9001-quality-management.html) - Quality management systems (3-year certification cycle).\n- [ISO 13485](https://www.iso.org/standard/59752.html) - Medical devices quality management (Annual surveillance).\n- [ISO 22000](https://www.iso.org/iso-22000-food-safety-management.html) - Food safety management (Annual surveillance).\n- [ISO/TS 16949](https://www.iatf.org/) - Automotive quality management (Annual surveillance).\n\n### Security, privacy \u0026 data protection\n\n- [CCPA](https://oag.ca.gov/privacy/ccpa) - California Consumer Privacy Act (self-declarative).\n- [CMMC](https://www.acq.osd.mil/cmmc/) - Cybersecurity framework for government contractors (Annual audit).\n- [CSA STAR](https://cloudsecurityalliance.org/star/) - Cloud security and compliance certification (depend on level).\n- [FedRAMP](https://www.fedramp.gov/) - Federal Risk and Authorization Management Program (Annual assessment).\n- [FISMA](https://www.cisa.gov/federal-information-security-modernization-act) - Federal Information Security Modernization Act (Annual audit).\n- [GDPR](https://gdpr.eu/) - General Data Protection Regulation (Self-assessment with DPO) (self-declarative).\n- [HIPAA](https://www.hhs.gov/hipaa/index.html) - Health Insurance Portability and Accountability Act (Regular audits required).\n- [HITRUST CSF](https://hitrustalliance.net/) - Security framework used in healthcare (Annual audit).\n- [ISO 27001](https://www.iso.org/isoiec-27001-information-security.html) - Information security management (Annual audit).\n- [ISO 27002](https://www.iso.org/isoiec-27002-information-security.html) - Security controls guidance for ISO 27001 (self-declarative).\n- [ISO 27017](https://www.iso.org/standard/43757.html) - Cloud-specific security practices (self-declarative).\n- [ISO 27018](https://www.iso.org/standard/76559.html) - Cloud privacy controls for protecting PII (self-declarative).\n- [ISO 27701](https://www.iso.org/standard/71670.html) - Privacy Information Management System standard (Annual audit).\n- [Microsoft SSPA](https://www.microsoft.com/en-us/trust-center/privacy/data-protection-requirements) - Microsoft's Supplier Security \u0026 Privacy Assurance (Annual audit).\n- [NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework) - Risk management framework for AI governance (self-declarative).\n- [PIPEDA](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/) - Personal Information Protection and Electronic Documents Act (self-declarative).\n- [SOC 1](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-1) - Reporting on internal financial controls (Annual audit).\n- [SOC 2](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2) - Service Organization Control reports (Annual audit).\n- [SOC 3](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3) - Public report summarizing SOC 2 compliance (Annual audit).\n- [US Data Privacy (USDP)](https://iapp.org/) - Generalized US data privacy regulations (self-declarative).\n\n## Tools \u0026 softwares\n\n### Compliance automation\n\n- [Drata](https://drata.com/) - Security compliance automation for SOC 2, ISO 27001, PCI DSS.\n- [Fortinet](https://www.fortinet.com/) - Security compliance automation platform.\n- [HIPAA One](https://www.hipaaone.com/) - HIPAA compliance for healthcare businesses.\n- [Oneleet](https://oneleet.com/) - End-to-end security compliance automation for SOC 2, ISO 27001, and more.\n- [Probo](https://github.com/getprobo/probo) - Compliance automation platform for SOC 2, ISO 27001 \u0026 more. ![Open Source](https://img.shields.io/badge/-Open%20Source-1a2029?logo=opensourceinitiative\u0026logoColor=white\u0026labelColor=00dc82)\n- [Secureframe](https://secureframe.com/) - Automated security compliance for SOC 2, ISO 27001, HIPAA.\n- [Sprinto](https://sprinto.com/) - Compliance automation for SOC 2, ISO 27001.\n- [Scrut](https://www.scrut.io/) - Compliane automation for security frameworks.\n- [Thoropass](https://www.thoropass.com/) - Compliance automation and audit management.\n- [Tugboat Logic](https://tugboatlogic.com/) - Security assurance platform for SOC 2, ISO 27001.\n- [Vanta](https://www.vanta.com/) - Automated security monitoring and SOC 2, ISO 27001, HIPAA compliance.\n\n### ESG \u0026 sustainability platforms\n\n- [Benchmark ESG](https://www.benchmarkdigital.com/) - ESG performance management.\n- [Diligent ESG](https://www.diligent.com/solutions/esg/) - ESG and board governance.\n- [Locus Technologies](https://locustec.com/) - ESG reporting and EHS compliance.\n- [Novata](https://novata.com/) - ESG solution.\n- [Novisto](https://novisto.com/) - ESG data management.\n- [Proof](https://proof.io/) - ESG data management.\n- [Sametrica](https://sametrica.com/) - ESG data collection.\n- [Workiva](https://www.persefoni.com/partners/workiva) - Financial and ESG reporting platform.\n\n### GRC\n\n- [AuditBoard](https://www.auditboard.com/) - Audit, risk and compliance management platform.\n- [Archer](https://www.archerirm.com/) - RSA's GRC platform.\n- [Hyperproof](https://hyperproof.io/) - Compliance operations platform with automated workflows.\n- [LogicGate](https://www.logicgate.com/) - Risk Cloud platform.\n- [MetricStream](https://www.metricstream.com/) - GRC Cloud platform.\n- [Onspring](https://www.onspring.com/) - Versatile GRC software.\n- [OneTrust](https://www.onetrust.com/) - Privacy \u0026 GRC platform.\n- [ServiceNow GRC](https://www.servicenow.com/products/governance-risk-and-compliance.html) - Enterprise GRC platform.\n- [TrustCloud](https://www.trustcloud.ai/) - GRC automation.\n\n### Risk \u0026 compliance management\n\n- [GRR Rapid Response](https://github.com/google/grr) - Open-source incident response framework by Google. ![Open Source](https://img.shields.io/badge/-Open%20Source-1a2029?logo=opensourceinitiative\u0026logoColor=white\u0026labelColor=00dc82)\n\n### Security assessment\n\n- [OpenVAS](https://github.com/greenbone/) - Vulnerability assessment scanner. ![Open Source](https://img.shields.io/badge/-Open%20Source-1a2029?logo=opensourceinitiative\u0026logoColor=white\u0026labelColor=00dc82)\n- [OSSEC](https://github.com/ossec/ossec-hids) - Host-based Intrusion Detection System. ![Open Source](https://img.shields.io/badge/-Open%20Source-1a2029?logo=opensourceinitiative\u0026logoColor=white\u0026labelColor=00dc82)\n- [Trivy](https://github.com/aquasecurity/trivy) - Vulnerability and compliance scanner for containers and infrastructure. ![Open Source](https://img.shields.io/badge/-Open%20Source-1a2029?logo=opensourceinitiative\u0026logoColor=white\u0026labelColor=00dc82)\n- [Wazuh](https://github.com/wazuh) - Security monitoring platform. ![Open Source](https://img.shields.io/badge/-Open%20Source-1a2029?logo=opensourceinitiative\u0026logoColor=white\u0026labelColor=00dc82)\n\n## Other ressources\n\n### Community\n\n- [Iso 27001 Forum](https://www.iso27001security.com/) - ISO27K forum.\n- [r/Compliance](https://www.reddit.com/r/Compliance/) - Reddit compliance community.\n\n### Content\n\n- [ISO27001.zip](https://www.iso27001.zip/) - Implementation guide for ISO 27001.\n- [MITRE ATT\u0026CK](https://attack.mitre.org/) - Open framework for understanding adversarial tactics and techniques.\n- [SOC2 FYI](https://www.soc2.fyi/) - Guide comparing available solution for SOC2.\n- [SOC2 reports](https://www.youtube.com/watch?v=jzrn_7vIePM) - Conference on what to expect from SOC2 reports.\n\n## Contributing\n\nFeel free to open a pull request if you'd like to add or update resources. Please ensure your contribution follows the [awesome list guidelines](https://github.com/sindresorhus/awesome/blob/main/contributing.md).\n\n## Related\n\n- [Awesome GDPR](https://github.com/oppoverbakke/awesome-gdpr).\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/getprobo%2Fawesome-compliance/projects"}