Open Source GRC
GRC platforms earn their keep by collapsing the duplicate work of overlapping audits - one control mapped once and reused across SOC 2, ISO 27001, and internal policy - so the value is in the cross-framework mapping, not any single checklist. The open source options here let you maintain that control library, evidence, and framework mappings on your own infrastructure, keeping audit evidence and the relationships between controls in a system you can extend as new frameworks land.
CISO Assistant
Open source GRC platform for risk, compliance, audit, privacy, and reporting
Comp AI
Open-source compliance platform for SOC 2, ISO 27001, HIPAA, and GDPR with AI agents and 580+ integrations
Probo
Self-hostable GRC platform for engineers with web, CLI, MCP, and GraphQL access
Deming
Open source ISMS tool for planning, monitoring, and reporting on ISO 27001 security measures
Openlane
Open-source compliance automation for SOC 2, ISO 27001, NIST 800-53, GDPR, and more
GovReady-Q
Open source GRC platform for self-service security assessments and compliance documentation
OpenRMF
Web-based tool for DoD STIG checklists, SCAP and Nessus scans, and NIST RMF reporting