AuditClaw GRC 治理、风险与合规管理

审计Claw GRC

AI-native GRC 助手 for OpenClaw. Manages 合规 框架s, controls, evidence, risks, policies, vendors, incidents, as设置s, trAIning, vulnerabilities, 访问 reviews, and questionnAIres.

97 actions | 30 tables | 13 框架s | 990+ controls

Security 模型 Database: SQLite at ~/.OpenClaw/grc/合规.sqlite with WAL mode, owner-only 权限s (0o600) 凭证s: Stored in ~/.OpenClaw/grc/凭证s/ with per-提供者 directories, owner-only 权限s (0o700 dirs, 0o600 files), atomic writes, and 安全 deletion (overwrite with random bytes before removal). Secrets are never 记录ged or exposed in 输出. See scripts/凭证_store.py for implementation. Trust center: 生成s a local HTML file only. Nothing is published externally. The user decides where to host it. Dependencies: 请求s==2.31.0 (pinned) for HTTP header 扫描ning. Cloud integrations optionally use 机器人o3 (AWS) and PyJWT (Azure) via try/except -- these are not required and only activate if 安装ed and 凭证s are 配置d. 扫描s: All security 扫描s (headers, SSL, GDPR) 运行 locally agAInst user-specified URLs only. No telemetry: No data is sent to external 端点s. All operations are local or to user-配置d cloud accounts only. Optional 环境 Variables (for cloud integrations)

These are not required for core GRC functionality. They are only used when the user explicitly 设置s up cloud 提供者 integrations via companion 技能s:

Variable Used by AWS_访问_KEY_ID / AWS_SECRET_访问_KEY AWS integration (via 审计claw-aws) GITHUB_令牌 GitHub integration (via 审计claw-github) AZURE_SUBSCRIPTION_ID / AZURE_命令行工具ENT_ID / AZURE_命令行工具ENT_SECRET / AZURE_TENANT_ID Azure integration (via 审计claw-azure) GCP_PROJECT_ID / GOOGLE_应用_凭证S GCP integration (via 审计claw-gcp) GOOGLE_WORKSPACE_SA_KEY / GOOGLE_WORKSPACE_ADMIN_EMAIL Google Workspace (via 审计claw-idp) OKTA_ORG_URL / OKTA_API_令牌 Okta (via 审计claw-idp) 设置up python3 {baseDir}/scripts/init_db.py pip 安装 -r {baseDir}/scripts/requirements.txt

Database: ~/.OpenClaw/grc/合规.sqlite

Voice and 格式化ting Present data as 格式化ted summaries, not raw JSON Keep messages under 4096 chars. Show top 5-10 rows, offer "Want the full 列出?" Emoji: ✅ complete, ⚠️ at-risk, 🔴 critical, 📊 scores, 📋 报告s, 🔒 security Include 上下文: "23/43 controls complete (53%)" not just "23" After each action, suggest the next 记录ical step Activation Triggers

Activate on: 合规, GRC, SOC 2, ISO 27001, HIPAA, GDPR, NIST, PCI DSS, CIS, CMMC, HITRUST, CCPA, FedRAMP, ISO 42001, SOX, ITGC, controls, evidence, risks, 审计, gap analysis, security posture, 合规 score, 框架, security 扫描.

Database Operations

All queries go through: python3 {baseDir}/scripts/db_查询.py --action [args]

输出 is JSON. 解析 and present as human-readable summaries. For full action reference with all arguments: {baseDir}/references/db-actions.md

Core Actions Action Purpose 状态 Overall 合规 overview activate-框架 --slug soc2 Load 框架 controls gap-analysis --框架 soc2 Gaps with priority and effort score-历史 --框架 soc2 Score trend over time 列出-controls --框架 soc2 --状态 in_进度 过滤器ed controls 更新-control --id 5 --状态 complete 更新 control (also batch: --id 1,2,3) 添加-evidence --title "..." --control-ids 1,2,3 Record evidence 添加-risk --title "..." --likelihood 3 --impact 4 记录 a risk 添加-vendor --name "..." --criticality high Register vendor 添加-incident --title "..." --severity critical 记录 incident 生成-报告 --框架 soc2 HTML 合规 报告 生成-仪表盘 仪表盘 summary + Canvas HTML 导出-evidence --框架 soc2 ZIP package for 审计ors 列出-companions Show 安装ed companion 技能s 添加itional Action Categories Policies: 添加, version, submit 应用roval, review, require acknowledgment TrAIning: 添加 模块s, as签名, 追踪 completion, 列出 overdue Vulnerabilities: 添加 with CVE/CVSS, 追踪 remediation 访问 Reviews: 创建 campAIgns, 添加 items, 应用rove/revoke QuestionnAIres: 创建 templates, 发送 to vendors, record answers, score Incidents: 添加 actions (timeline), post-incident reviews, summary with MTTR As设置s: register with classification, lifecycle, 加密ion/备份/补丁 状态 Alerts: 添加, 列出, acknowledge, resolve Integrations: 添加 提供者, test connection, 设置up 图形界面de, show policy 框架 Activation

运行: python3 {baseDir}/scripts/db_查询.py --action activate-框架 --slug

框架 Slug Controls SOC 2 Type II soc2 43 ISO 27001:2022 iso27001 114 HIPAA Security Rule hipaa 29 GDPR gdpr 25 NIST CSF nist-csf 31 PCI DSS v4.0 pci-dss 30 CIS Controls v8 cis-controls 153 CMMC 2.0 cmmc 113 HITRUST CSF v11 hitrust 152 CCPA/CPRA ccpa 28 FedRAMP Moderate fedramp 282 ISO 42001:2023 iso42001 40 SOX ITGC sox-itgc 50

框架 reference docs: {baseDir}/references/框架s/

合规 Score

运行: python3 {baseDir}/scripts/合规_score.py [