GRC Lake

Turn security evidence into traceable control assessments and reviewable audit workpapers. Open-source and self-hosted: read evidence from the systems and security lakes you already run, evaluate versioned control tests, and retain evidence and recorded review decisions alongside the results.

• Traceable: follow results to source records and rule versions, and inspect the recorded mapping decisions; snapshots form a hash-chained ledger you can re-verify.
• Works with what you have: connect cloud, identity, endpoint, and code systems directly, or query OCSF tables already in your lake.
• One control, many frameworks: reusable safeguards map to SOC 2, ISO 27001, NIST, and more, with reviewed and proposed mappings kept apart.

Open the live demo → Click through the console on recorded synthetic data. The hosted demo is read-only; it does not connect to your systems or establish live-provider coverage. Nothing to install.

Quick start · Product tour · Connect evidence · Already on OCSF? · Frameworks · Performance · Self-host · Docs

Quick start

Python 3.11+ and uv:

uvx --from "grc-lake[server]" grc-lake demo

This loads a synthetic company into a temporary lake, serves the console on localhost:8787 without authentication, and opens your browser. Ctrl+C stops it and deletes the lake. With pip: pip install "grc-lake[server]", then grc-lake demo.

First task: find a failing control, inspect its evidence and mapping, and export the frozen result: follow the sample-data tutorial, then the auditor workpaper example.

For a real evaluation, follow the bounded pilot guide: one source, one independently checked result, then a repeat collection and review.

Keep a lake, Docker, source development, or MCP

Keep a lake between runs:

grc-lake fixtures load --company golden --out ./lake --rebase-times
grc-lake serve --server --allow-insecure-no-auth --lake ./lake

Docker (public image, no registry login):

git clone --branch v0.3.17 --depth 1 https://github.com/koda-ai-studio/grc-lake.git
cd grc-lake && docker compose up

Current source, with uv and Node 22+:

git clone https://github.com/koda-ai-studio/grc-lake.git
cd grc-lake && uv sync --frozen --extra dev --extra server && make demo-local

MCP over stdio (headless GRC covers agent credentials):

pip install "grc-lake[server,mcp]"
GRC_LAKE_LAKE=./lake grc-lake-mcp

Release notes: changelog · verified release records.

Product tour

Collect → Evaluate → Resolve → Export. These console captures use the bundled synthetic company, refreshed for the 0.3.17 release. They illustrate source behavior; see the release records for published-package verification.

Start with the assessment overview

Assessed coverage, open findings, evidence freshness, and priority actions in one view.

Explore framework coverage

Catalogued, mapped, reviewed, and assessed requirements stay separate measures per framework.

Inspect control results and evidence

Filter by result, owner, or framework; open a control for its evidence, findings, freshness, and confidence.

Navigate control families and the CCF

The Common Control Framework (CCF) groups reusable safeguards into families linked to framework requirements. Proposed mappings are not attestable. How common safeguards work.

Trace a finding through the evidence graph

Follow exact records between controls, safeguards, evidence, repositories, and assets; drill in or roll up.

Review AI assets and their next actions

Models and agents with owners, environments, governance signals, and next actions. Recorded lineage is evidence presence, not a passing control (AI inventory semantics).

Five-minute console tour · How evidence investigation works

Architecture

Read-only collection feeds deterministic evaluation; console, REST API, CLI, and MCP share one evidence and assessment model.

flowchart LR
  Sources["Cloud · identity · code · existing lakes"] --> Collect["Read-only collection"]
  Collect --> Evaluate["Version-pinned control tests"]
  Evaluate --> Assessments["Assessment generations"]
  Assessments --> Review["Console · API · CLI · MCP"]
  Assessments --> Export["Snapshots · workpapers · OSCAL"]

Exports: portable CCF/OSCAL bundles, framework coverage reports, and verifiable auditor workpapers. Recovery behavior and API limits: architecture guide and assessment contract.

Connect evidence

Use direct connectors or read an existing lake. Both are read-only and keep assessment evidence in storage you operate.

Supported sources

Stages, permissions, and live receipts: connector catalog · qualification matrix. Missing a source? Request a connector or build one.

Already on OCSF?

If your telemetry is already normalized to OCSF, for example in Amazon Security Lake or OCSF tables on Databricks or Snowflake, point GRC Lake at those tables. Keep your existing source-ingestion pipeline: GRC Lake runs read-only queries, retains a mapped copy and evaluates the rows it imports. Built-in presets bind events to CCF safeguards, and framework requirements follow each safeguard's reviewed crosswalk:

flowchart LR
  A["OCSF Authentication 3002<br/>successful Logon, is_mfa"] --> S1["SG-IDENTITY-001<br/>Logical access and MFA"]
  B["OCSF Account Change 3001<br/>Attach Policy"] --> S2["SG-IDENTITY-002<br/>Access review"]
  G["OCSF Group Management 3006<br/>Add User, Assign Privileges"] --> S2
  V["OCSF Vulnerability Finding 2002<br/>EC2 instance, ECR image"] --> S3["SG-VULNERABILITYMANAGEMENT-001<br/>Vulnerability management"]
  C["OCSF Compliance Finding 2003<br/>EC2 instance"] --> S4["SG-CONFIGBASELINE-001<br/>Hardened configuration baselines"]
  S1 --> R1["SOC 2 CC6.1 · NIST 800-53 IA-2<br/>CIS AWS 1.10 · …"]
  S2 --> R2["SOC 2 CC6.2 · ISO 27001 A.8.2 · …"]
  S3 --> R3["SOC 2 CC7.1 · ISO 27001 A.8.8<br/>NIST 800-53 RA-5 · …"]
  S4 --> R4["NIST CSF PR.PS-01 · …"]

What the rules conclude, and a Databricks example

The rules state only what an event shows. A successful logon with MFA passes for that user; one without MFA is open. A privilege grant, including adding a user to a group, blocks an access-review pass until someone reviews it, but is not a failure. Vulnerability findings and configuration checks keep their own status and bind a safeguard only for resource types with a clear catalog equivalent. Failed sign-ins, API activity, and detection findings stay unbound. Proposed crosswalk mappings are never attested.

CREDS='{"host":"dbc-example.cloud.databricks.com","warehouse_id":"abc123","catalog":"security",
        "schema":"ocsf","client_id":"<sp-client-id>","client_secret_ref":"DATABRICKS_CLIENT_SECRET"}'
OPTS='{"mappings":[{"preset":"ocsf/authentication","source":{"table":"ocsf_events"}},
                   {"preset":"ocsf/account_change","source":{"table":"ocsf_events"}}]}'
grc-lake connectors probe --lake ./lake --connector-id databricks-evidence-lake \
  --credentials-json "$CREDS" --options-json "$OPTS"
grc-lake connectors configure --lake ./lake --connector-id databricks-evidence-lake \
  --state enabled --credentials-json "$CREDS" --options-json "$OPTS"
grc-lake connectors sync --lake ./lake --connector-id databricks-evidence-lake
grc-lake frameworks assessment --lake ./lake

Preview a preset against sample rows with grc-lake lake map --dry-run. Rules, limits, and Snowflake, ClickHouse, BigQuery, and Iceberg setup: OCSF events in the CCF.

Frameworks

Coverage means several different things: a catalogued requirement, a reviewed mapping and an assessed result are separate. Start with the per-framework coverage matrix; proposed mappings cannot establish an attested pass.

Catalog and reviewed-mapping counts

• Reviewed requirements by framework: SOC 2 49/61, ISO 27001 43/93, HIPAA 0/24, PCI DSS 0/12 (top-level), NIST CSF 2.0 72/106, NIST SP 800-53 399/1,014 (381 source-native self-maps). Every pack is in the coverage matrix.
• 21 framework packs, 2,282 catalogued requirements (1,995 distinct; FedRAMP Moderate's 287 rows restate NIST SP 800-53 controls), linked through 1198 safeguards, including source-native assessment contracts. 2,196 requirements have safeguard mappings; 886 have reviewed mappings and the other 1,310 are proposed. Of the reviewed, 381 are source-native self-maps (written from that requirement's own pinned source) and 505 rest on reviewed crosswalk mappings; 0 rest only on legacy reviews with no recorded reviewer. The blended total is not a per-framework readiness figure.
• 28 executable adapters (18 implemented, 10 preview) and 3 configuration boundaries. Read-only provider collection includes OCSF presets for existing security lakes.
• Evidence stays scoped: missing or stale evidence leaves gaps; a passing sample does not prove complete population coverage. Proposed mappings are not attestable.
• One engine, four surfaces: console, REST API, CLI, and MCP server. Agents propose; humans approve.

Framework coverage · Common safeguards · Audit readiness · Qualification

What these numbers mean

Counts are generated from source. Reviewed counts record maintainer mapping decisions (review method and limits); mapping decisions do not change access at a provider. The audit-readiness index shows score, evaluated-framework, and blocking-gap gates, so a high score cannot hide an unresolved framework assessment. Fixture tests, screenshots, and the demo do not establish live-provider accuracy, production capacity, certification, or an audit opinion; see the roadmap for remaining gaps.

Performance and qualification

The accepted local graph profile exercises two tenants with up to 10k synthetic records each and four concurrent clients. Its limits are successful warm p95 ≤500 ms, first/expired reads ≤5 seconds and process RSS ≤1 GiB, with both tenants continuing to progress under overload. Three recorded runs passed. Admission and rate-limit rejections are reported separately; this is not a promise that every request under overload succeeds.

This profile covers authenticated depth-one graph reads on local SQLite. It does not qualify 100k interactive use, browser rendering, external storage or production sizing. Check provider qualification and verified release records separately.

Bounded live runs are recorded as receipts with every verdict checked against the provider: an AWS and GitHub pilot that moved from no framework results to 103 failing requirements and one attested pass, and a Databricks run on a populated audit log. Each covers one account or workspace, not provider-wide qualification.

Self-host

Deploy with Docker or Helm on infrastructure you control:

• Local: one writable replica with a filesystem lake.
• Distributed: API replicas and tenant workers share PostgreSQL and S3-compatible storage (distributed guide).
• Production: SSO and scoped credentials, retention, and backup/restore.

Releases ship signed provenance and an SBOM (verify artifacts). Upgrading from TrustOps? Read the migration guide.

Engineering review

Start with one control and follow its evidence into a verified workpaper: the synthetic access/change workflow runs passing, failing, missing, stale, conflicting, and incomplete-population cases.

Where to look for each review question

Run checks from the revision under review; the CI badge tracks main, and benchmark receipts name their own revisions and workloads.

Documentation

All documentation · License: Apache 2.0