GRC Brain

A compliance consultant's working knowledge, as agent skills and a structured pattern library. SOC 2, HIPAA, CJIS, ISO 27001 — field-tested by the consultants at Cycore Secure.

These are working methods from real audit engagements, not summaries of framework PDFs. Install them and your agent picks up the judgment a compliance consultant applies every day: what auditors actually test, what evidence survives fieldwork, how to write a finding that an engineer can act on.

Built by Cycore Secure, a compliance firm that runs SOC 2, HIPAA, and ISO 27001 engagements end to end. If you want it done for you, talk to us. If you want it packaged for your own LLM with commercial-use rights, see GRC Brain Pro.

What's inside

Folder	What it is	License
skills/	6 agent skills: SOC 2 advisor, HIPAA advisor, CJIS advisor, compliance calendar, gap assessment, evidence reviewer	MIT
patterns/	The complete pattern library: 78 SOC 2 + 12 HIPAA implementation patterns	CC BY-NC-ND 4.0
reference/	Regulation and policy notes: the FBI CJIS Security Policy v6.1, by topic	CC BY-NC-ND 4.0
crosswalks/	Seed of the cross-framework control library (SOC 2 ↔ ISO 27001 ↔ HIPAA ↔ GDPR)	CC BY-NC-ND 4.0
guides/	Implementation guides and field notes, in plain markdown	CC BY-NC-ND 4.0

The skills

• soc2-advisor — answers SOC 2 questions from the bundled patterns: what a control means in plain language, what evidence auditors expect, how to respond to pushback.
• hipaa-advisor — HIPAA Security Rule guidance with the distinction that matters: Required vs. Addressable, and Covered Entity vs. Business Associate applicability.
• cjis-advisor — FBI CJIS Security Policy guidance for vendors and agencies: who actually needs fingerprint-based screening, when encryption obligations attach, what a priority tier does and does not mean, and why no CJIS certification exists.
• compliance-calendar — generates a 12-month audit-readiness calendar of recurring tasks (access reviews, backup tests, vendor reviews) scoped to your frameworks.
• gap-assessment — runs a readiness assessment from your evidence and writes findings the way a consultant does: observed condition, why it matters, remediation that names the artifact and the test.
• evidence-reviewer — QA for deliverables and evidence packages before they reach an auditor: terminology, control-ID validity, confidentiality leaks, screenshot hygiene.

Technical overview

The corpus is structured data, not an essay collection: 90 patterns, ~93,000 words, covering all 20 SOC 2 criterion families (CC1–CC9, A1, C1, PI1, P1–P8) plus the HIPAA implementation set.

• Fixed frontmatter schema, 100% populated: stable pattern_id (SOC2-CC6.2-AccessControlPolicy-001), version, last_validated, controls, and also_satisfies cross-framework edges — so multi-framework reuse is computable, not manual. HIPAA patterns add required_or_addressable.
• Invariant section structure across every pattern (Trigger → Implementation steps → Role split → Required policies → What auditors expect → Variations → Firm-specific deviations → Pushback → Related → Provenance), so an agent can address a section by name across the whole corpus.
• Per-pattern provenance: each pattern records its standard basis (AICPA TSP100 criterion, SSAE 18 methodology, or regulation text), which audit firms corroborated it and under what criterion identifier, the anonymized engagement profiles behind the recipe, and its validation date.
• The repo is a build artifact. A deterministic export pipeline materializes it from the upstream knowledge base in four passes: selection, ordered substitution, link rewriting, and index generation. Editing patterns/ directly is a defect.
• Two gates. A private registry-driven anonymization gate runs before every push; a public structural gate runs in CI on every push and PR (schema validation, link resolution, leak patterns). History was initialized from a single audited commit.

Full detail: ARCHITECTURE.md.

The white paper

How this library was built — why the pattern is the right unit of knowledge, the universal-first editorial rule and the multi-firm corroboration behind it, the knowledge architecture (skills retrieve, patterns know), a step-by-step account of how the skill files were extracted from production consulting tooling, and the anonymization pipeline that gates every commit.

The patterns

Each pattern file covers one control implementation: trigger, step-by-step consultant workflow, role split, effort estimate, and a What auditors expect section grounded in AICPA TSP100 / the regulation text — standard control statement, tested attributes, evidence shape, the sentence the auditor will write, and common pushback with resolutions.

This is the complete library, not a sample: all 78 SOC 2 patterns across every Trust Services Criterion, and all 12 HIPAA patterns. Start at the index: SOC 2 · HIPAA.

The CJIS reference set

CJIS works differently from SOC 2 and HIPAA, so it ships as reference notes rather than implementation patterns: reference/cjis/ covers the FBI CJIS Security Policy v6.1 by topic — the control families, the Security Addendum, the cloud and personnel rules, priority tiers, per-state variance, and the v6.0 → v6.1 delta, plus a priority crosswalk giving every control its tier.

Three things it exists to stop people getting wrong: CJIS does not mandate FedRAMP, its MFA bar is AAL2 with replay resistance rather than phishing resistance, and a control's priority tier is not its deadline — an asterisked tier is already sanctionable. Start at reference/cjis/_index.md.

Install

Claude Code (plugin):

claude plugin marketplace add cycoresecure/grc-brain

Skills CLI:

npx skills add cycoresecure/grc-brain

Manual: clone the repo and copy any folder from skills/ into your project's .claude/skills/ directory. Each skill is self-contained.

GRC Brain Pro

This repository is the open edition of GRC Brain: every skill, every pattern, free. GRC Brain Pro is the commercial edition for people who want it working inside their own LLM in an afternoon, with rights to use it in paid client work:

• the install harness: setup guides for Claude, ChatGPT, and Cursor, the tuned system prompt, and worked example prompts
• the firm-calibration deep material: how audit firms actually differ in sampling, cadence, and evidence expectations
• the full cross-framework control library (SOC 2 ↔ ISO 27001 ↔ HIPAA ↔ GDPR — the seed in crosswalks/ is 20 of 159 controls)
• 12 months of curated updates
• the commercial license: unlimited client engagements and white-label rights (this repo's pattern license is non-commercial)

Details at cycoresecure.com.

Who this is for

• Startups running their own compliance program — use the skills and the full pattern library directly.
• Consultants — the methodology skills (gap-assessment, evidence-reviewer, compliance-calendar) slot into client work as-is.
• Anyone evaluating Cycore — this is how we work. The repo is the portfolio.

What this is not

• Not legal advice, and not a replacement for your auditor.
• Not a GRC platform. The skills generate documents and answers; tracking lives wherever you track work.
• Not AI-generated framework summaries. Every pattern was written from engagements and validated against fieldwork.

Contributing

PRs to skills/ are welcome — see CONTRIBUTING.md. The patterns/, reference/, crosswalks/, and guides/ folders are maintained by Cycore (they mirror the commercial library), but issues pointing out errors are very welcome and get fixed fast.

Licensing

• skills/ — MIT. Use them anywhere, including commercially.
• patterns/, reference/, crosswalks/, guides/ — CC BY-NC-ND 4.0. Read, share, and use internally with attribution; no resale or redistribution in commercial products. The CJIS Security Policy itself is a US Government work and carries no such restriction — the license covers our commentary on it, not the policy.

---

Maintained by Cycore Secure. No client data has ever touched this repository — every file passes an automated anonymization gate before merge.