Every compliance framework, ready on day one
GRC Eye ships with 85+ pre-loaded frameworks and more than 5,000 controls, with crosswalk mappings, including eight Saudi frameworks in their official English and Arabic wording. Fork any framework to create your own editable copy, or build a completely custom one from scratch with the AI-powered builder.
85+
Built-in frameworks
5,000+
Pre-mapped controls
Day 1
Ready to assess
∞
Custom frameworks you can create
The frameworks your auditors will ask for
The most common certifications and regulatory requirements, fully loaded, crosswalk-mapped, and audit-ready.
ISO 27001:2022
93 Annex A controls plus clauses 4–10
The global ISMS standard. Annex A controls with applicability, evidence per control, and cross-mapping to NIST and SOC 2.
SOC 2 Type II
Trust Services Criteria
5 Trust Service Criteria. Audit-ready evidence collection, readiness checklist, and auditor portal.
GDPR
Regulation (EU) 2016/679
Key GDPR obligations as assessable requirements: lawfulness, data subject rights, security of processing, breach notification and processor contracts.
DORA
Regulation (EU) 2022/2554
All 5 pillars: ICT risk, incident reporting, resilience testing, TPRM, and information sharing.
NIS2 Directive
Directive (EU) 2022/2555
Risk management, incident reporting, supply chain security, and board accountability measures.
NIST CSF 2.0
6 functions · 106 subcategories
Updated 2024 version. 6 functions: Govern, Identify, Protect, Detect, Respond, Recover.
85+ frameworks in total, including HIPAA, CIS Controls v8, MITRE ATT&CK, NIST 800-53, PCI DSS, IEC 62443, TISAX, NERC CIP, NCA ECC and SAMA CSF
Saudi regulatory frameworks — official wording in English and Arabic, cross-mapped to NCA ECC
Eight frameworks from the National Cybersecurity Authority, the Saudi Central Bank (SAMA) and SDAIA, loaded in the regulators' own wording. Assess them in English or Arabic and reuse evidence across all of them.
- Arabic readers see the regulator's official Arabic text, labelled "Official text"
- Every framework is cross-mapped to NCA ECC-2:2024, so evidence is collected once
- Alongside UAE, Qatar, Bahrain and Tunisian regulations in the same library
NCA ECC-2:2024
Official EN + AR text
NCA CCC-2:2024
Official EN + AR text
NCA DCC-1:2022
Official EN + AR text
NCA CSCC-1:2019
Official EN + AR text
NCA OTCC-1:2022
Official EN + AR text
NCA TCC-1:2021
Official EN + AR text
SAMA CSF
Official EN + AR text
SDAIA PDPL
Official EN + AR text
The complete framework library
Organised by region and category. Each framework ships pre-loaded with its controls and requirements, ready to assess and cross-map.
Middle East & North Africa
- NCA ECC-2:2024
- NCA CCC-2:2024
- NCA DCC-1:2022
- NCA CSCC-1:2019
- NCA OTCC-1:2022
- NCA TCC-1:2021
- SAMA CSF
- SDAIA PDPL
- UAE NESA IAS
- UAE IA Standard
- Dubai DESC ISR
- Qatar NIA CSF
- Bahrain CBB ISR
- BCT Circular 2021-05 (Tunisia)
- BCT Circular 2006-19 (Tunisia)
- Décret 2004-1250 (Tunisia)
- Loi 2004-5 (Tunisia)
- Loi organique 2004-63 (Tunisia)
ISO / IEC standards
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- ISO/IEC 27005:2022
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- ISO/IEC 42001:2023
- ISO 22301
- ISO/IEC 20000-1
- ISO 31000
- ISO 9001:2015
Europe
- GDPR (EU)
- NIS2 Directive
- DORA
- EU AI Act
- PSD2
- BSI C5 (Germany)
- ANSSI RGS (France)
- UK Cyber Essentials
- FINMA Circ. 2023/1 (Switzerland)
US Government & NIST
- NIST CSF 2.0
- NIST SP 800-53 Rev 5
- NIST SP 800-171
- NIST SP 800-37 (RMF)
- NIST Privacy Framework
- FedRAMP Rev 5
- CMMC 2.0
- CJIS
- ITAR
- NYDFS Part 500
- CCPA / CPRA (California)
Industry Standards
- SOC 2 Type II
- PCI DSS 4.0
- HIPAA
- HITRUST CSF
- CIS Controls v8
- SWIFT CSP
- COBIT 2019
- ITIL 4
- Secure Controls Framework (SCF)
Threat, AppSec & AI security
- MITRE ATT&CK
- OWASP Top 10
- OWASP ASVS 4.0
- CSA CCM
- CIS FortiGate 7.4 Benchmark
- Google SAIF
- NIST AI RMF 1.0
OT / ICS & sector-specific
- IEC 62443 (OT/ICS)
- NIST SP 800-82 Rev 3 (OT/ICS)
- ENISA ICS/SCADA
- NERC CIP (Energy)
- NCA OTCC-1:2022 (OT)
- TISAX (Automotive)
Asia-Pacific & other privacy laws
- Essential Eight (Australia)
- APRA CPS 234 (Australia)
- PIPL (China)
- DPDPA (India)
- PDPA (Singapore)
- PDPA (Thailand)
- LGPD (Brazil)
- PIPEDA (Canada)
- POPIA (South Africa)
Take any framework and make it yours
Every built-in framework is protected and shared across all organisations, so it stays accurate and up to date. But one click creates your own private, fully editable copy: a fork.
Fork with one click
Click Customize on any built-in framework card. GRC Eye creates an exact copy (all controls, categories, cross-walk mappings, and parent/child relationships) owned entirely by your organisation.
Edit controls inline
Rename controls to match your internal terminology. Edit descriptions, assessment criteria, and evidence requirements. Delete controls that do not apply. Add new custom controls that are unique to your environment.
Add proprietary requirements
Your forked framework is fully independent. Add your company-specific security requirements, internal policies, or sector-specific obligations that no off-the-shelf framework covers.
Your fork, your data
The original built-in framework remains unchanged for all other organisations. Your fork is only visible to your team. No changes flow back to the shared library.
Framework Library
ISO/IEC 27001:2022
93 controls · Cross-mapped to SOC 2 & NIST CSF
ISO 27001 - Acme Corp (Custom)
93 controls + 7 custom · Forked from ISO 27001:2022
The original ISO 27001 remains unchanged for all other orgs
Custom Framework Builder
Identity & Access Management
Access Control
Privileged Access Review
Access Control
Incident Classification Policy
Incident Response
AI Model Risk Assessment
AI Governance
AI suggestion
Based on "AI Governance" category, consider adding: AI Training Data Management, Model Version Control, and Algorithmic Bias Assessment controls, aligned with EU AI Act Article 9–12.
Build any framework from scratch
No suitable framework exists? Build one. The custom framework builder lets you define any control set (for internal security standards, supplier requirements, or proprietary risk methodologies) and use it exactly like a built-in framework throughout GRC Eye.
Define your control structure
Create categories, add controls with IDs, titles, descriptions, and evidence requirements. Organise them in any hierarchy you need.
AI helps you build it
Describe what the control should cover and the AI drafts the control language, tailored to your industry, jurisdiction, and regulatory context. You review, approve, and publish.
Map to built-in frameworks
Link your custom controls to ISO 27001, NIST, or any other framework you are running. Evidence uploaded to your custom control automatically satisfies the mapped built-in controls.
Run assessments and audits
Your custom framework works identically to any built-in one: gap analysis, compliance scoring, auditor portal, evidence collection, and board-ready reporting all work out of the box.
Multi-framework crosswalk: no duplicate work
GRC Eye pre-maps controls across frameworks. Upload your Access Control Policy once and it satisfies ISO 27001 A.8.3, SOC 2 CC6.1, GDPR Art. 32, and NIST CSF PR.AC-1 simultaneously.
| Evidence / Control | ISO 27001 | SOC 2 | GDPR | NIST CSF |
|---|---|---|---|---|
| Access Control Policy | A.8.3 | CC6.1 | Art. 32 | PR.AC-1 |
| Encryption at Rest | A.8.24 | CC6.7 | Art. 32(1)(a) | PR.DS-1 |
| Incident Response Plan | A.5.26 | CC7.3 | Art. 33 | RS.RP-1 |
| Vulnerability Management | A.8.8 | CC7.1 | Rec. 2017/1584 | DE.CM-8 |
Upload evidence once
One document upload satisfies multiple framework controls automatically. No re-uploading, no copy-paste, no duplicate work for your team.
See coverage across all frameworks
The cross-framework view shows which controls are already covered, which are partially covered by another framework, and which still have gaps.
Add a second framework in days
Already certified for ISO 27001? Adding SOC 2 takes days, not months: 60–70% of controls are already satisfied by your existing evidence.
Three ways to use frameworks in GRC Eye
Every path gives you the same audit-ready, crosswalk-mapped, evidence-linked programme.
01
Use built-in
Select from 85+ pre-loaded frameworks. Controls and crosswalk mappings ready instantly. No setup needed.
02
Fork & customise
One click creates your own private, fully editable copy of any built-in framework. Rename, edit, delete, or add controls without affecting the original.
03
Build from scratch
Use the custom framework builder to create any control set (internal security standards, supplier requirements, or proprietary risk methodologies) with AI assistance.
"We forked ISO 27001 and added our 14 internal controls in an afternoon. The whole framework was live and crosswalk-mapped to our existing evidence by end of day."
Alex F.
Head of Security, Enterprise SaaS, Berlin
"We built a custom DORA compliance framework specific to our ICT risk appetite. GRC Eye treated it identically to any built-in framework: full audit trail, evidence collection, the works."
Marie D.
Chief Risk Officer, FinTech, Luxembourg
Start with 85+ frameworks, customise as you grow
Full framework library access from day one. Fork, customise, or build your own. Free 14-day trial: no credit card, no consultants, no setup fees.