# www-project-it-grc **Repository Path**: Link2World_admin/www-project-it-grc ## Basic Information - **Project Name**: www-project-it-grc - **Description**: No description available - **Primary Language**: Unknown - **License**: Not specified - **Default Branch**: master - **Homepage**: None - **GVP Project**: No ## Statistics - **Stars**: 0 - **Forks**: 0 - **Created**: 2025-10-24 - **Last Updated**: 2025-10-24 ## Categories & Tags **Categories**: Uncategorized **Tags**: None ## README # **grc4ciso (GRC)** ### **Introduction** This project provides you a GRC (Governance, Risk and Compliance) platform focused to manage Cybersecurity risks, control design and compliance. With this platform you can comply with ISO 27001:2022, PCI 4.0 and other security requirements, also you can implement an Information Security Management System, execute Cybersecurity Risk analysis and evaluation, design controls and get reports, to demonstrate trust to your customers, stakeholders and regulators, and stay compliant with cybersecurity frameworks. The platform has the following functionalities: - Asset management. - ISMS: Information Security Management System (based on ISO27001:2022). - PCI: PCI DSS v4.0.1 Report on Compliance Template. - Risk Management. - Control. - Compliance. - Settings. ### **Asset Management** Assets that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy. Understanding the organization’s assets (e.g., data, hardware, software, systems, facilities, services, people), suppliers, and related cybersecurity risks enables an organization to prioritize its efforts consistent with its risk management strategy and the mission needs. Inventories of software, services, and systems managed by the organization are maintained. image Assets are prioritized based on classification, criticality, resources, and impact on the mission. image image Inventories of services provided by suppliers are maintained. image Also you can generate reports and charts about TCP ports, IT components, data classification, business processes. image ### **Information Security Management System (ISMS)** The platform provides you with the 93 ISO 27001:2022 controls already loaded, security attributues, security concepts, categories, so you basically need to complete the statement aplicability to show an Information Security Management System implemented in your organization. image image image Statement of applicability are related to controls, so you can show evidence of compliance with each requirement of the ISO27001 standard. This also ensures that the selected controls are aligned with the identified risks. The status is calculated based on the controls that are related to each requirement, so you can link it with policies, procedures or evidences that demonstrate its implementation. image Also, you can get reports and charts about the Information Security Management System status. image image ### **Risk Management** You can evaluate risks using CVSS (Common Vulnerability Score System) calculator integrated in the risk module. image The inherent risk is automatically calculated based on the impact and probablity levels assigned to each risk factor. image Residual risk is also automatically calculated based on the design and effectivenes evaluation of the controls assigned to mitigate risk factors. image image ### **Threat Scenario** Identify and characterize threat sources of concern, including capability, intent, and targeting characteristics for adversarial threats and range of effects for non-adversarial threats. Organizations identify threat sources of concern and determine the characteristics associated with those threat sources. For adversarial threat sources, assess the capabilities, intentions, and targeting associated with the threat sources. For non-adversarial threat sources, assess the potential range of effects from the threat sources. image ### **CVE Search** This feature integrates with www.cve-search.org to retrieve CVE data for risk assessment. This feature helps organizations identify, evaluate, and manage vulnerabilities affecting their assets. image image ### **Control** Once you identify and evaluate risks, you should design the controls to mitigate such risks, so in the control module you can design, evaluate, and approve controls. Each control has a flow (draft, designed, implemented, approved), so the controls can be audited and evaluated to ensure they are effective to mitigate risks. image ### **Compliance** Stay compliant with cybersecurity frameworks. The platform also can be used to show compliance with legal, external or other compliance requirements like PCI, NIST, CIS Controls and OWASP. image In this module you can register the controls associated to each compliance requirement, so you can link it with policies, procedures or evidence that demonstrate its implementation. You can also get reports and charts about compliance status. image image ### **Settings** In this module basically you manage users, roles and privileges. If necessary, you can activate two factor authentication to users. ## **grc4ciso Roles** R - Read, W - Write, C - Create, u - Unlink | | Asset Management | ISMS | Risk Management| Control | Compliance | Settings| | --------|-------------|-------|------------|------------|------------|------------| | GRC Admin | RWCU | RWCU | RWCU | RWCU | RWCU | RWCU | | GRC Consultant |RWCU|RWCU|RWCU|RWCU|RWCU|RWCU| | Asset Management|RWCU|R|R|R|R|R| | ISMS |R|RWCU|R|R|R|R| | Risk Management|R|R|RWCU|R|R|R| | Control|R|R|R|RWCU|R|R| | Compliance |R|R|R|R|RWCU|R| | Guest|R|R|R|R|R|R| ### **Other Functionalities** You can send notifications to other users to inform about updates, requirements, collaboration or other information you want to communicate. image A log is generated to record all the activities that users perform in the system. image ### **Docker Installation** 1. Install docker. 2. Create docker instances, grc4ciso works with Odoo 16. `docker run -d --net [YOUR_NETWORK] --restart=always -p 5432:5432 --shm-size=256m -e POSTGRES_USER=odoo -e POSTGRES_PASSWORD=[POSTGRES_PASSWORD] -e POSTGRES_DB=postgres --name [INSTANCE_NAME] postgres:latest` `docker run -d --net [YOUR_NETWORK] --restart=always -p 8069:8069 -p 8072:8072 --name [INSTANCE_NAME] --link [DB_INSTANCE_NAME]:db -e PASSWORD=[PSTGRES_PASSWORD] -t odoo:16.0-20250207` 3. Install the following pip packets in the odoo docker instance `pip3 install cvss==2.6 xw_utils==1.1.12 json5==0.9.14 openai markdown markdown2 json2table` 4. Configure Odoo https://[YOU_HOST]:8069 5. Into your Odoo instance, clone the project in /mnt/extra-addons `git clone https://github.com/OWASP/www-project-it-grc` 6. In /etc/odoo/odoo.conf add the addons-path www-project-it-grc image 7. With "developer mode" execute "Apps" --> "Update Apps List". image 8. Install the grcbit_* modules. image ### **Import data** To import data to your database, you can use "Favorites" --> "Import records" option. image Data repository: https://github.com/grcbit/grc4ciso-data-1 ### **Demo** - https://democommunity.grc4ciso.com/ - guest / guest123 ### **Contact** - email: rodolfo.lopez@outlook.com