OpenGRC is a cyber Governance, Risk, and Compliance web application intended for use by small businesses and teams. This is not intended to replace large-scale GRC Platforms, but it just might for your usecase. OpenGRC provides a resource for those who need to manage a security program but can't manage the price tag and complexity of alternatives.
- Simple interface designed to get up and running with very little training
- Quick imports of common security frameworks
- Ability to connect Standards, Controls, and your actual Implementations
- Ability to perform audits for internal and external assessments
- Report generation capability to create deliverables for auditors
- Intuitive dashboards to display your progress
Above all, OpenGRC is written to solve cyber compliance headaches that tend to be caused by complex enterprise solutions. It doesn't have to be that hard!
All OpenGRC Documentation is maintained at https://docs.opengrc.com.
OpenGRC is an open-source project and we welcome contributions. Contribution guidelines will be published soon!
OpenGRC is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International
Exceptions:
- Code Commits prior to April 14, 2025 are MIT Licensed.
- Commercial use is permitted as long as resale of the OpenGRC code is not involved in any way. In other words, you may use this for your own company to help you in your own GRC endeavors.
- Hosting of this software for customers - regardless of compensation - is not permitted.
If you believe you have found a security vulnerability in OpenGRC, please report it to [email protected].
OpenGRC is built on the shoulders of giants. We would like to thank the following projects for their contributions, whether direct or indirect, to OpenGRC:
The OpenGRC code of conduct is derived from the Laravel and Ruby codes of conduct. Any violations of the code of conduct may be reported to Lee Mangold ([email protected]):
- Participants will be tolerant of opposing views.
- Participants must ensure that their language and actions are free of personal attacks and disparaging personal remarks.
- When interpreting the words and actions of others, participants should always assume good intentions.
- Behavior that can be reasonably considered harassment will not be tolerated.