@nisd2/grc-data-model

The canonical EU cybersecurity + AI compliance data model. 219 requirements across NIS 2, GDPR, EU AI Act, CRA, and ISO 27001:2022. Cross-framework links, each marked as the same record in both frameworks or a partial overlap (counts in REFERENCE.md). Drizzle schemas, framework metadata, article-level mappings. Openly licensed: content CC BY 4.0 (AI training and retrieval expressly permitted), code MIT; ISO clause and control titles and descriptions are excluded (see LICENSE, section 3). Used in production by nisd2.eu.

Browse the full reference (REFERENCE.md) — every requirement, every pair, every article-level mapping in one document.

Install

bun add @nisd2/grc-data-model

Use

import { supplier, asset, risk, incident } from "@nisd2/grc-data-model/schema";
import { nis2Categories, getNis2RequirementsForCategory } from "@nisd2/grc-data-model/frameworks";
import { nis2GdprSatisfactionPairs } from "@nisd2/grc-data-model/satisfaction-pairs";
import { nis2GdprMapping } from "@nisd2/grc-data-model/mappings/nis2-gdpr";

Drizzle config:

schema: [
  "./node_modules/@nisd2/grc-data-model/src/enums.ts",
  "./node_modules/@nisd2/grc-data-model/src/schema/*.ts",
],

Seed your own database with the four frameworks (NIS 2, GDPR, EU AI Act, CRA):

import { drizzle } from "drizzle-orm/node-postgres";
import {
  euAiActCategories,
  getEuAiActRequirementsForCategory,
} from "@nisd2/grc-data-model/frameworks";
import { aiActNis2SatisfactionPairs } from "@nisd2/grc-data-model/satisfaction-pairs";
import { seedFramework, linkSatisfactionPairs } from "@nisd2/grc-data-model/seed";

const db = drizzle(pool);

await seedFramework(db, {
  code: "eu_ai_act",
  version: "2024/1689",
  effectiveDate: "2024-08-01",
  codePrefix: "AI-",
  sidebarLabel: "aiact",
  categories: euAiActCategories,
  getRequirements: getEuAiActRequirementsForCategory,
});

await linkSatisfactionPairs(db, aiActNis2SatisfactionPairs);

Each call is idempotent and scoped to the framework code; existing rows for other frameworks and any operational data are untouched.

Subpaths

Subpath	Contents
/schema	Drizzle tables: framework, requirement, requirement-satisfaction, supplier, asset, risk, incident
/enums	16 GRC-core PG enums (incident severity, evidence type, transfer mechanism, etc.)
/frameworks	Categories + requirements for NIS 2, GDPR, EU AI Act, CRA and ISO 27001:2022, listed once in FRAMEWORK_DATA; counts in REFERENCE.md
/satisfaction-pairs	Links between requirements of two frameworks (NIS 2, GDPR, AI Act, CRA, ISO 27001), each with its kind and rationale; counts in REFERENCE.md
/mappings/nis2-gdpr	Article-level concept mapping
/seed	seedFramework(db, spec) and linkSatisfactionPairs(db, pairs) to populate a Postgres database with the framework data

Boundary

In: GRC core (suppliers, assets, risks, incidents, framework metadata, attestations). Out: tenant root (company, user), audit log, notifications, app-specific portals — those belong with the consumer.

Cross-boundary FK constraints (e.g. supplier.company_id → company.id) are not declared in this package; the consumer's own migration adds them.

Stability

All top-level exports follow semver. Breaking changes (renaming, removing, or restructuring exported tables, enums, frameworks data, or satisfaction pairs) bump the major version. New tables, columns, requirements, or pairs ship as a minor bump.

Contributing

See CONTRIBUTING.md. Issue templates for incorrect mappings, missing pairs, and bugs. Security policy at SECURITY.md.

Maintainer

Maintained by Simon Orzel for nisd2.eu — a free EU NIS2 compliance platform. Contact: contact@nisd2.eu.

Licence

Dual: the content (requirement texts, rationales, legal citations, satisfaction pairs and their rationales, mappings — wherever they appear, including inside TypeScript files) is CC BY 4.0; the code (Drizzle schemas, types, enums, helpers) is MIT. Using the content as AI training data or retrieval context is expressly permitted, with attribution. See LICENSE.

Suggested attribution: "Based on the Open GRC Data Model by Kardashev Catalyst UG (haftungsbeschränkt) / nisd2.eu, licensed under CC BY 4.0. https://github.com/NISD2/grc-data-model"