bra0-domain-grc-cybersecurity

Domain ontology (TBox + canonical ABox) for GRC cybersecurity practice. Machine-readable extension of bra0.org/docs/guides/grc-cybersecurity.html.

Status

v0.1 — DRAFT (2026-05-04). Minimal viable scope:

• 12 canonical standards (NIS2, DORA, AI Act, GDPR, ISO 27001, SOC 2, HDS, CIS, OWASP, PCI DSS, IEC 62443, EBIOS RM)
• 3 scanner types (IT, OT, Cloud)
• 6 RSSI value chain phases (Inventory / Detect / Understand / Decide / Remediate / Prove)
• 4 SHACL shapes (Standard, Regulation, ScannerType, RSSIValueChainPhase)

See ROADMAP.md for v0.2 plan.

Files

File	Purpose
grc-cybersecurity.ttl	TBox + canonical ABox
grc-cybersecurity.shapes.ttl	SHACL shapes (rudof-validatable)
README.md	This file
ROADMAP.md	v0.2 plan
LICENSE-MIT	MIT license
LICENSE-APACHE	Apache-2.0 license

Namespace

Canonical IRI: https://schema.bra0.org/domain/grc-cybersecurity# (registered under bra0 namespace registry per ADR-057).

Resolved via schema.bra0.org GitHub Pages publication, gated by ontology quality audit per ADR-057 §2.4.

Validation

rudof shacl-validate -s grc-cybersecurity.shapes.ttl grc-cybersecurity.ttl
# expect: exit 0

Cross-domain dependencies

• edgy: — https://schema.bra0.org/cross-domain/edgy# (mid-level enterprise-design vocabulary)

This ontology adds GRC-cybersecurity-specific classes and instances on top of the cross-domain TBox. Client-specific instances (a particular RSSI's roadmap, a specific organisation's compliance posture) live in private client ABox repos, not here.

Companion guide

The public guide bra0.org/docs/guides/grc-cybersecurity.html is the prose narrative ; this repo is the machine-readable counterpart. Each canonical standard listed in the guide corresponds to an instance in grc-cybersecurity.ttl.

License

Dual-licensed under either of:

• MIT License (LICENSE-MIT or https://opensource.org/licenses/MIT)
• Apache License 2.0 (LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0)

at your option (per bra0 ecosystem convention).