Scytale Open-Source Claude Code Skills for GRC

Free, MIT-licensed Claude Code skills for governance, risk, and compliance — covering the frameworks compliance teams actually live with. An open-source contribution from Scytale.

Why this exists

Compliance work is slow because the people doing it are drowning in specialized knowledge — control IDs, evidence templates, cross-framework mappings, audit playbooks. Claude Code is a great collaborator when it has that knowledge loaded. This repo packages it as ten installable skills so any engineer, security practitioner, GRC owner, or auditor can turn their terminal into a credible compliance partner — for free, under MIT, forever.

Built on Scytale expertise + industry best practices

Every skill in this repo is grounded in two sources:

1. Scytale’s experience helping hundreds of companies — startups through enterprises — get and stay compliant across SOC 2, ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, SOX ITGC, and more. The patterns, working styles, and “what auditors actually ask for” guidance reflects what we see across real engagements every day.
2. The authoritative public standards and best-practice references — AICPA Trust Services Criteria, ISO/IEC 27001:2022, NIST SP 800-53 Rev. 5, NIST CSF 2.0, GDPR Articles + EDPB guidance, 45 CFR (HIPAA), PCI DSS v4.0.1, PCAOB AS 2201, ISA/IEC 62443, NIST SP 800-66 / 800-82 / 800-137, TSA Security Directives, and more.

The skills themselves are vendor-neutral and product-agnostic — they don’t promote Scytale’s platform. Use them on any project, in any company, regardless of your compliance stack.

What’s inside