r/grc

We are ready to get serious with our data governance posture now that our privacy program is maturing and we keep seeing about the multi-million dollar fines happening each week for non-compliance. So in doing a security and privacy audit my job is to clean things up but I want to include tracking scripts, not just the usual vulnerability scan items that fall under a normal cybersecurity audit but leaves out trackers and pixels. The main site has the usual marketing setup of facebooks meta-pixel, tiktok, linkedin insights tag, and microsoft clarity, but nobody has verified consent behavior in a while and theres no consent mechanism that currently works on the site despite procurement purchasing a solution from some well funded startup back in 2020 but looks like they haven't maintenanced it and its dormant now. If you were preparing for a real review, what evidence would you collect? Network logs, vendor inventory, consent records, data flows, policy screenshots, GTM export? Trying to build a practical checklist.

What it is

A self-hosted AI assistant for GRC (Governance, Risk & Compliance) and cybersecurity. You ask a plain-language question ("What are the DPDPA breach-notification timelines?") and it answers from a curated corpus of 2,681 real controls across 48 frameworks (GDPR, HIPAA, ISO 27001, NIST, PCI DSS, SOC 2, RBI, DPDPA, DORA, and more) with inline citations back to the specific control and its official source URL, plus a verification-tier badge so you know how trustworthy each source is.

Design goals: runs entirely on your own hardware, near-zero infra cost, no data ever leaves the machine (it's compliance data that's the whole point), and a clean integrable API so it's not locked to the bundled UI.

The stack

Backend (Rust)

• Axum 0.8 + Tokio async API, SSE streaming
• LanceDB (embedded vector DB) for dense retrieval + Tantivy (BM25) for sparse — merged with Reciprocal Rank Fusion.
• No external vector-DB service.
• Ollama for local inference: bge-m3 embeddings (1024-dim) + qwen2.5:7b-instruct generation
• SQLite (rusqlite) for users, hashed API keys, audit log, and persistent chat history — everything embedded, one file
• JWT + API-key dual auth with RBAC (viewer/admin); RFC 7807 error envelopes; OpenAPI/Swagger auto-generated via utoipa
• SearXNG (self-hosted metasearch) as a live-web-search fallback when the corpus is thin or the question is time-sensitive

Frontend: React + TypeScript + Vite + Tailwind v4, streaming chat UI, collapsible "thinking" reasoning trace, citation panel, admin console (coverage/audit/API-key issuance)

Ops

• Multi-stage Docker with cargo-chef layer caching, single-binary that also serves the built frontend (one port, no separate frontend host)
• Eval harness (retrieval precision@k + a grounding/hallucination check) and a drift monitor that re-checks high-stakes facts (penalties, deadlines, circular numbers) against their source URLs on a schedule

Features that actually work right now

• Hybrid retrieval -> grounded, cited answers (token-streamed)
• Persistent chat -> generation runs as a detached backend task, so an in-flight answer survives a reload/tab-close and gets saved regardless
• Thinking mode toggle -> runs a deeper pipeline (query rewriting → rerank → self critique) and streams the reasoning steps
• Live-web-search toggle, per-framework filtering, thumbs feedback logging
• Full auth/RBAC/audit trail

Being honest about the rough edges

• It's CPU-bound on my dev box (no GPU) a 7B model answer takes ~1-2 min; streaming hides most of it but a GPU is the real fix
• Small local models (1.5B/0.5B) drop citations under long RAG context instruction following degrades; 7B is the floor for reliable citing. Interesting problem I'd love input on.
• Single-node, self-hosted MVP not horizontally scaled yet
• The corpus went through two automated audit/fix passes but hasn't had a formal expert review

Why open source

Compliance tooling is either eye-wateringly expensive SaaS or spreadsheets. A self hostable, private, auditable RAG assistant over open framework data feels like something the community should own. Planning to open it up once the core is battle-tested.

Happy to go deep on any part the RRF hybrid retrieval, the detached-generation persistence model, the cargo-chef Docker setup, the citation-grounding eval, whatever. What are you all building in this space?

Currently got our IT risk register in Jira, it’s fine but a bit clunky.

Has anyone used a tool for IT risk that’s actually been worth it.

For context, we’re at the start of our risk management journey, we’ve got a register but it’s not really being managed properly. My main goal is just to make it easy for our risk owners to review risks assigned to them without being clouded by everything else, assign out tasks and manage and track things accordingly.

Doing some research on a pain I keep hitting as a devops engineer. SOC 2 A1.2/A1.3 wants evidence that you test recovery, not just that backups ran, and Type II wants it continuously over the observation window.

For those who've been through it:

1. What did your auditor actually accept as restore-test evidence? (screenshots? a runbook doc? ticket trail?)
2. How often do you really run test restores vs. what your policy says?
3. Who owns this: compliance, or whoever runs the databases?
4. Is this a "scramble the week before the audit" thing or genuinely automated for anyone?

Trying to figure out if this is as universally duct-taped as it looks from where I sit. War stories appreciated.

We recently conducted a manual audit of our google workspace environment at a mid-sized company and discovered numerous sensitive files including customer contracts and internal financial reports shared publicly with 'anyone with the link'

Many of these files were created years ago by former employees. I’m currently going through thousands of files manually, which is taking forever.

How are other GRC and security teams handling discovery and remediation of historical data exposure like this at scale? Looking for best practices, tools, or efficient processes that have worked for you?

thanks!

I'm evaluating GRC platforms for my own use and keep finding mixed opinions online.

For those of you who work with GRC tools every day, if you were starting from scratch today, which platform would you choose and why?

I'd be especially interested in hearing about what you like, what frustrates you, and whether you'd choose the same platform again.

I want to build an incident response plan for my organization can someone guide me the resources I should follow to build the workable program?

My organization already has a good security stack they lack the IR plan I wanna know how a effective IR program looks like what to add and what to ignore

Any resources books, blogs, talks much appreciated.

Thanks in advance.

Nine questions in the career megathread. I noticed the last reply was two weeks ago, and before that, four. I’m guessing people posted there to get some sort of help, so I figured I’d mention it.

@mods or anyone. Appreciate it!

starting to build a digital asset risk framework before the business side commits to anything, and the standard counterparty risk models don't translate cleanly. The market spans unchartered technology companies to federally regulated banks and all of them describe themselves in broadly similar terms.

The failure mode question is hardest to structure. Key management failure in digital assets isn't a clean analog to traditional custody failure, and recoverability depends on the custody architecture in a way that doesn't apply to most other counterparty risk categories.

Has anyone built a taxonomy for digital asset infrastructure that maps onto existing operational risk frameworks, particularly around the charter tier distinction?

Sanity checking our approach on the compliance side before an assessment. We're going for FedRAMP and a chunk of our vulnerability findings have no vendor fix available, the patch simply doesn't exist yet. A lot of them come from third-party components we don't build because remediation isn't in our hands. We can't close them and we can't ignore them, they go on the POA&M.

We prioritise with exploitability signals, CISA KEV and EPSS such that we know which no-fix items are worth escalating versus just monitoring. The part I'm unsure about is the long-term optics. That POA&M line just grows, criticals sitting as monitored with no close date because the fix is outside our control.

What I'm really after is whether this holds up at assessment. If you've taken a growing no-fix POA&M through a 3PAO, do they let it ride as monitored or force close dates and deviation requests on you.

I want to know how everyone structures their enterprise risk register.

Do you track:

• Inherent & residual risk?
• KRIs?
• Controls?
• Treatment plans?
• Review dates?

What's one field you've added that turned out to be surprisingly valuable?

I'm a cybersecurity student in Brazil with ISO 27001 Foundation (PECB), currently completing my first real GRC project for a small business (security policies, risk matrix, LGPD compliance documentation). I'm looking to gain hands-on experience by assisting an experienced GRC or ISO 27001 consultant on real projects. I can help with documentation, asset inventories, risk assessments, and operational support. Happy to work for free or for a very small fee. DMs open.

The Cyber Resilience Act covers products with digital elements - software and connected products sold in the EU. The big compliance deadlines are still a way off, but a lot of organizations are already having to bake security requirements into their dev process now.

Curious how others are actually tackling this:
Have you started tying security requirements, vulnerability handling, patching, and risk assessment into the product lifecycle?

And what's the hardest part to nail down - the tech itself, the process, who's accountable, the documentation, interpreting the legal text, or the supply chain?

It always felt like another compliance task until we started finding forgotten VMs, old cloud resources, and systems nobody remembered owning.

Turns out "you can't secure what you don't know exists" isn't just a cliché.

What's one compliance requirement you've ended up appreciating more over time?