Compliance Open Source Projects

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

immudb - immutable database based on zero trust, SQL/Key-Value/Document model, tamperproof, data change history

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

Tfsec is now part of Trivy

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

Open Source Cloud Native Application Protection Platform (CNAPP)

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 150+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

Cloud Security Posture Management (CSPM)

CSV data manipulation made easy in PHP

A FAST Kubernetes manifests validator, with support for Custom Resources!

InSpec: Auditing and Testing Framework

Security automation content in SCAP, Bash, Ansible, and other formats

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

HardeningKitty and Windows Hardening Settings

🛡️ Awesome Cloud Security Resources ⚔️

macOS Security Compliance Project

Open-source infrastructure and data orchestration platform for risk decisioning

OPC Unified Architecture .NET Standard

A TOML toolkit written in Rust

A suite of tools to automate software compliance checks.

Best Practice Auditd Configuration

NIST Certified SCAP 1.2 toolkit

Appshark is a static taint analysis platform to scan vulnerabilities in an Android app.

A developers guide to HIPAA compliance and application development.

🧵 CLI tool for directly patching container images!

A subset of JavaScript language to use in nginx

Configuration guidance for implementing the Windows 10 and Windows Server 2016 DoD Secure Host Baseline settings. #nsacyber

Compliance automation framework, focused on SOC2

HummerRisk 是云原生安全平台，包括混合云安全治理和云原生安全检测。

A very simple and easy to understand RISC-V core.

Secure Vault for Customer PII/PHI/PCI/KYC Records

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

a lightweight, security focused, BDD test framework against terraform.

Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules. Take this survey to provide feedback about cfn-guard: https://amazonmr.au1.qualtrics.com/jfe/form/SV_bpyzpfoYGGuuUl0

Application Framework for Python

PacBot (Policy as Code Bot)

Linting tool for CloudFormation templates

Plugin for sudo that requires another human to approve and monitor privileged sudo sessions

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Wazuh - Docker containers

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

Curated list of resources for security Governance, Risk Management, Compliance and Audit professionals and enthusiasts (if they exist).

ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.

Open Security Controls Assessment Language (OSCAL)

S.U.P.E.R.M.A.N. optimizes the macOS software update experience.

DevSec Linux Baseline - InSpec Profile

The GDPR Checklist

PHP's time range API

Personal Web Assistant

Rudder is a configuration and security automation platform. Manage your Cloud, hybrid or on-premises infrastructure in a simple, scalable and dynamic way.

Security compliance platform - SOC2, CMMC, ASVS, ISO27001, HIPAA, NIST CSF, NIST 800-53, CSC CIS 18, PCI DSS, SSF tracking

Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners + OpenAI GPT with One Report (Code, IaC) - Betterscan Community Edition (CE)