GRC automation patterns

How to read this#

This is a catalogue of patterns, not a product list. No tool, vendor or product is recommended. Each entry states the problem the pattern solves, how it works, the evidence it produces, where it breaks, and the guardrail that keeps it honest.

The order is deliberate: patterns one and two produce the records everything else consumes, and monitoring built before an evidence pipeline monitors nothing traceable. Read each entry against the last column of the summary table, because a pattern serving no stated requirement is a dashboard looking for an owner.

Where a pattern touches a model or an agent, the capability statements are GRCIDE's working view, marked as such.

Patterns#

1. The evidence pipeline#

Problem. Evidence is assembled by hand before an audit, out of screenshots whose producer, date and population are unrecorded.

How it works. Each system of record exports on a schedule into one store. Every item is normalised to one envelope: what the record is, which control it serves, who produced it, when, and how long it is kept.

Evidence it produces. A dated, attributable record set that can be re-derived rather than re-collected. The envelope answers to ISO/IEC 27001:2022 clause 7.5, documented information, and to clause 7.5.3, Control of documented information ^{1 2}.

Where it breaks. When an item is stored without its producer or timestamp. It cannot be re-derived, so an assessor cannot test it, however good the collection rate looks.

Guardrail. Nothing enters the store without producer, timestamp, retention and the control it serves. ISO/IEC 27002:2022 control 8.15, Logging, requires that activities, exceptions, faults and other relevant events are logged, and that those logs are stored, protected and analysed ³. Generating evidence is one of the purposes it states. Compliance evidence deserves the same handling.

2. Control mapping as data#

Problem. The mapping from obligation to control lives in one spreadsheet, so the chain from a legal point to a record cannot be walked without the person who built it.

How it works. Obligation, control objective, control and evidence are held as records with stable identifiers, and each relationship is a row of its own. The result is a small graph queried in either direction: from an article to the records proving it, and from a record to what breaks without it.

Evidence it produces. A traversable chain and a coverage report showing obligations with no control and controls with no evidence. The method behind those artefacts is in From regulation to controls.

Where it breaks. When the graph hides the judgement that produced it. A relationship row records a decision; without the reasoning and the date beside it, the mapping is an assertion nobody can defend.

Guardrail. Keep the treatment decision as a record of its own, under ISO/IEC 27001:2022 clause 6.1.3, Information security risk treatment ⁴. Compare the selected controls against Annex A, Information security controls reference, afterwards rather than before ⁵. The external requirements feeding the graph are a maintained record under ISO/IEC 27002:2022 control 5.31, Legal, statutory, regulatory and contractual requirements ⁶. The control asks for those requirements to be identified, documented and kept current.

3. Continuous control monitoring#

Problem. Control effectiveness is asserted once a year, from a sample chosen by whoever had time.

How it works. Each control in scope gets a test with three fixed parts: the population it runs over, the rule deciding pass or fail, and the threshold at which failure becomes an action. Tests run on a schedule, writing results to the evidence store.

Evidence it produces. A time series per control, with the population size and failure list per run. That is the input ISO/IEC 27001:2022 clause 9.1, Monitoring, measurement, analysis and evaluation, asks for ⁷.

Where it breaks. When thresholds are set by the tool rather than agreed with the control owner, or when a test measures the tool's coverage instead of the control's outcome.

Guardrail. ISO/IEC 27002:2022 control 5.36, Compliance with policies, rules and standards for information security, asks that compliance be regularly reviewed ⁸. Its guidance suggests considering automated measurement and reporting tools so that the regular review stays efficient. Control 8.16, Monitoring activities, asks for monitoring of networks, systems and applications for anomalous behaviour, and for monitoring records kept to a defined retention period ⁹. The matching CSF 2.0 Category is Continuous Monitoring, DE.CM, which covers monitoring assets to find anomalies, indicators of compromise and other potentially adverse events ¹⁰.

4. Policy as code for platform controls#

Problem. A configuration standard written in prose drifts from the estate within weeks, and an assessor finds the gap before the owner does.

How it works. The standard is expressed as machine-readable rules evaluated against the platform's own description of itself. Rules either block a change before it lands or report on what already exists. In our working view most estates need both, since only the second covers what was built before the rules existed.

Evidence it produces. A rule set under version control, a per-resource result set, and a record of every exception with an expiry date.

Where it breaks. At the edge of what the platform can express. Identity decisions, supplier obligations and human judgements stay outside the rule set, so a programme counting only rule coverage reports itself compliant while the untestable half goes unexamined.

Guardrail. The CSF Category is Platform Security, PR.PS, covering hardware, software and services of physical and virtual platforms. Its Subcategories include PR.PS-01, configuration management practices are established and applied, and PR.PS-05, installation and execution of unauthorized software are prevented ¹¹. A change to the rule set is a change to a control. ISO/IEC 27002:2022 control 8.32, Change management, puts changes to information processing facilities and information systems under change management procedures ¹².

5. The risk register with live inputs#

Problem. The register is refreshed in a workshop twice a year, so between workshops it describes an estate that has moved on.

How it works. Named fields draw from live sources: vulnerability records, the supplier register, monitoring results, open findings. The assessment itself stays a human act, and each drawn field carries its source and the date it was read.

Evidence it produces. A register whose quantitative fields each carry a provenance, and a change history showing what moved and why. The register method is in The risk register people trust.

Where it breaks. When a feed quietly replaces the judgement. A count of open vulnerabilities is an input to a likelihood assessment, never the assessment itself.

Guardrail. The Risk Assessment Category in CSF 2.0, ID.RA, keeps the two apart. ID.RA-01 has vulnerabilities in assets identified, validated and recorded; ID.RA-05 has threats, vulnerabilities, likelihoods and impacts used to understand inherent risk and inform risk response prioritization ¹³. Running the process sits under ISO/IEC 27001:2022 clause 8.1, Operational planning and control ¹⁴.

6. The audit workspace#

Problem. An audit runs on email threads, so nobody can say which requests are open, which sample was drawn, or what answered a question from three weeks ago.

How it works. One workspace holds evidence requests, sample selections, responses and findings. Every request names the control, the period and the population; every response points at items already in the evidence store instead of attaching copies.

Evidence it produces. A request log, a sampling record, and a finding record dated from raising to closure. Closure is run as set out in Running the external audit.

Where it breaks. When sampling follows whoever answers first. A sample drawn from the records that were easy to find is not a sample, and an auditor who spots it widens the scope.

Guardrail. ISO/IEC 27001:2022 clause 9.2 requires a planned internal audit programme, with criteria and scope defined per audit ¹⁵. Auditors are selected so objectivity and impartiality are preserved, and clause 9.2.2 is titled Internal audit programme ¹⁶. Findings close under clause 10.2, Nonconformity and corrective action ¹⁷. Control 5.35, Independent review of information security, asks for independent review of the approach to managing information security, at planned intervals or on significant change ¹⁸. The reviewers are people independent of the area under review.

7. The compliance copilot#

Problem. Most of a compliance officer's week goes on retrieving records, restating one control description for another audience, and checking whether two instruments ask the same thing.

How it works. A language model is given retrieval over the evidence store and the control graph, a house structure to draft against, and a fixed boundary. GRCIDE's working view of that boundary has two halves. The copilot may retrieve, draft, summarise and cross-reference. It may not decide, attest or own a control: an attestation is a statement by an accountable role, and a control owner is a role in the management system.

Evidence it produces. Drafts citing the records behind them, a log of the interactions, and the named person who accepted each artefact. Those logs are ordinary logging under ISO/IEC 27002:2022 control 8.15.

Where it breaks. In three named risk classes. The current list is the OWASP Top 10 for LLM Applications 2026, released on 3 August 2026 ¹⁹. Its entries LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure and LLM03 Excessive Agency are the three this pattern meets ²⁰. The first matters because a copilot in this pattern reads supplier documents, findings and tickets, all content an outsider can write into. The second matters because evidence is what an organisation least wants leaving its boundary. The third is a copilot allowed to act.

The framing in Agent governance is a permissions problem applies unchanged: what the copilot reaches, and what it inherits from the account running it, are the first controls to specify.

Guardrail. Where the copilot forms part of a high-risk system under the AI Act, oversight is a design requirement. Such systems must be designed so they can be effectively overseen by natural persons while in use ²¹. The Article names automation bias. Those assigned oversight must stay aware of the tendency to rely or over-rely on output, particularly where the system informs decisions taken by people ²². They must also be able to disregard, override or reverse that output ²³.

Two further duties attach. Providers and deployers must take measures supporting the AI literacy of their staff. The duty extends to other persons dealing with the operation and use of AI systems on their behalf ²⁴. The measures take account of technical knowledge, experience, education, training and the context of use. High-risk systems must technically allow automatic recording of events over the system's lifetime ²⁵. The scope test is in EU AI Act for security governance.

Summary#

Pattern	Produces	Fails when	Requirement it serves
Evidence pipeline	Normalised records with producer, date and retention	Items are stored without provenance	ISO/IEC 27001:2022 clause 7.5.3
Control mapping as data	A traversable obligation-to-record chain and a coverage report	The judgement behind a relationship is not stored	ISO/IEC 27001:2022 clause 6.1.3; ISO/IEC 27002:2022 control 5.31
Continuous control monitoring	A per-control time series with population and failures	Thresholds are set by the tool, not the owner	ISO/IEC 27001:2022 clause 9.1; ISO/IEC 27002:2022 control 5.36
Policy as code	A versioned rule set, per-resource results, dated exceptions	Coverage is claimed for what the platform cannot express	NIST CSWP 29 PR.PS; ISO/IEC 27002:2022 control 8.32
Risk register with live inputs	A register whose quantitative fields carry provenance	A feed replaces the assessment	NIST CSWP 29 ID.RA
Audit workspace	Request log, sampling record, dated findings	Sampling follows whatever was easiest to find	ISO/IEC 27001:2022 clauses 9.2, 10.2; ISO/IEC 27002:2022 control 5.35
Compliance copilot	Cited drafts, an interaction log, a named acceptor	The draft is treated as the attestation	Regulation (EU) 2024/1689 Articles 4, 12, 14, where in scope

Where automation breaks down#

Five failures account for most of the disappointment, and none is a tooling problem.

• Evidence without provenance. A collection rate is not a control. An item that cannot be traced to a producer, date and population cannot be tested, so the pipeline has automated the appearance of readiness.
• The mapping that hides judgement. Every relationship in a control graph was once a decision. Stored without its reasoning and date, it becomes folklore, and the first challenge unravels it.
• The dashboard nobody owns. The Oversight Category in CSF 2.0, GV.OV, has the results of organization-wide cybersecurity risk management activities used to inform, improve and adjust the risk management strategy ²⁶. A dashboard informing no decision fails that outcome, however current its data.
• The copilot that writes the attestation. Drafting is delegable; asserting is not. Where the output states a fact about a control, the record names whoever accepted it, and that acceptance is what an auditor asks to see.
• Automation of a control that does not exist. A test built for a control with no owner and no objective returns a green result for nothing. Objectives come first, under ISO/IEC 27001:2022 clause 6.2, and owners are roles, under clause 5.3 ^{27 28}.

Glossary#

Term	Definition	Source
Agent	An AI system that can understand context, formulate plans and take independent actions to achieve specified objectives	CSA Singapore, Advisory on Cybersecurity Risks of OpenClaw 29
Artefact	An output a programme keeps: a register, a minute, a report, a signed acceptance	GRCIDE working definition
Continuous control monitoring	Running a control's test on a schedule, over a stated population, against an agreed threshold	GRCIDE working definition, anchored to clause 9.1, Monitoring, measurement, analysis and evaluation 7
Control test	A rule deciding whether a control held over a stated population and period, with a threshold for action	GRCIDE working definition
Copilot	A language-model assistant scoped to retrieve, draft, summarise and cross-reference, barred from deciding, attesting or owning a control	GRCIDE working definition
Drift	The distance between a control as written and the estate as configured, at a point in time	GRCIDE working definition
Evidence	A record an outsider can inspect, with a producer, a frequency and a retention period	Clause 7.5.3, Control of documented information 2
Policy as code	A configuration standard expressed as machine-readable rules evaluated against the platform's own description of itself	GRCIDE working definition
Profile	In CSF 2.0, the Core outcomes an organisation currently achieves or targets, used to run a gap analysis and an action plan	NIST CSWP 29 §3.1 30
Provenance	The producer, timestamp, population and retention attached to a record, enough for it to be re-derived	GRCIDE working definition

Change log#

Date	Change
2026-09-05	First publication. Every clause, control and Subcategory read from the primary text.

References#

<!-- The rendered Sources block comes from the markers above; this list carries the publisher, title and URL behind them. -->

1. ISO. ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Clauses 5.3, 6.1.3, 6.2, 7.5, 7.5.3, 8.1, 9.1, 9.2, 9.2.2, 10.2, Annex A. https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-3:v1:en ³¹
2. ISO. ISO/IEC 27002:2022 — Information security, cybersecurity and privacy protection — Information security controls. Controls 5.31, 5.35, 5.36, 8.15, 8.16, 8.32, from the licensed copy. https://www.iso.org/standard/75652.html ⁶
3. National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 2024-02-26. Appendix A Categories GV.OV, ID.RA, PR.PS, DE.CM; §3.1 Profiles. https://doi.org/10.6028/NIST.CSWP.29 ¹⁰
4. OWASP Foundation, OWASP GenAI Security Project. OWASP Top 10 for LLM Applications 2026, released 2026-08-03; the document is downloaded from the resource page. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ ³²
5. European Parliament and Council. Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026, Articles 4, 12, 14. CELEX 02024R1689-20260727. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727 ²¹
6. Cyber Security Agency of Singapore. Advisory on Cybersecurity Risks of OpenClaw, 28 May 2026. https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-005/ ²⁹