Skip to content
← Tools / Skills
Skill · .md packageSushegaad/10 trustVerified
Claude Skills for GRC logo

Claude Skills for GRC

36 compliance skills: ISO 27001, SOC 2, GDPR, EU AI Act, and more.

Visit official site →

About

A collection of 36 Claude skills covering governance, risk, and compliance frameworks — ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, ISO 42001, the EU AI Act, DORA, India's DPDPA, CCPA/CPRA, SOX ITGC, and others. Each skill bundles audit-ready templates, control mappings, and gap-analysis workflows, and can be installed individually as a .skill file or through the Claude Code marketplace (e.g. /plugin install gdpr-compliance@grc-skills). The author reports benchmark scores of 89% with the skills versus 55% without, graded by independent agents — treat vendor-run evals as directional rather than proof. MIT licensed; 955 stars and 210 commits indicate real, ongoing maintenance.

What it can do

  • 36 framework skills (ISO 27001, SOC 2, GDPR, HIPAA, EU AI Act, DORA, DPDPA, SOX ITGC, and more); gap-analysis workflows with control mappings; audit-ready policy and evidence templates; per-skill .skill bundles and marketplace install; vendor-published eval results.

Setup

Upload an individual .skill file in Claude Desktop, or run /plugin install <skill>@grc-skills in Claude Code (e.g. /plugin install gdpr-compliance@grc-skills)

Prerequisites

Claude Desktop or Claude Code.

Use cases

Running a SOC 2 or ISO 27001 gap assessmentDrafting GDPR data processing addenda and privacy noticesPreparing evidence packages for compliance auditsChecking product changes against the EU AI Act

Works with

Trust score — 9/10

/10 trustVerified

Scored 9/10 (verified tier, metrics-v1). Evidence: 955 stars, 185 forks, MIT license, 210 commits, 22 releases — strong maintenance and adoption signals. 36 individually-installable .skill files plus marketplace install; eval figures (89% vs 55%) are vendor-reported and should be treated as directional..

★ 955 GitHub stars

Sources

Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.