Zeezhu/grc-security-frameworks

GRC Security Frameworks Dataset

A comprehensive dataset for training AI models on Governance, Risk, and Compliance (GRC) frameworks and cybersecurity standards.

Dataset Overview

This dataset contains 3,225 high-quality training examples covering major security and compliance frameworks. It's designed for fine-tuning large language models to become expert GRC assistants.

Covered Frameworks

• —CIS Controls v8.1.2 - 153 safeguards across 18 control families
• —Cloud Controls Matrix (CCM) v4.0.12 - 197 cloud security controls
• —NIST SP 800-53 Rev 5 - 200 security and privacy controls
• —NIST Cybersecurity Framework v2.0 - 22 subcategories across 6 functions
• —NIST AI Risk Management Framework v1.0 - 72 AI governance actions

Dataset Structure

Configurations

The dataset is available in two formats:

1. Alpaca Format (alpaca)

Standard instruction-tuning format with three fields:

{
  "instruction": "What is CIS Control 1.1?",
  "input": "Provide details about this safeguard.",
  "output": "CIS Control 1.1: Establish and Maintain Detailed Enterprise Asset Inventory...",
  "metadata": {
    "source_framework": "CIS Controls v8.1.2",
    "control_id": "1.1",
    "dataset_type": "unified_controls"
  }
}

2. ChatML Format (chatml)

Conversational format with role-based messages:

{
  "messages": [
    {
      "role": "system",
      "content": "You are a GRC compliance expert..."
    },
    {
      "role": "user",
      "content": "What is CIS Control 1.1?"
    },
    {
      "role": "assistant",
      "content": "CIS Control 1.1: Establish and Maintain Detailed Enterprise Asset Inventory..."
    }
  ],
  "metadata": {
    "source_framework": "CIS Controls v8.1.2",
    "control_id": "1.1",
    "dataset_type": "unified_controls"
  }
}

Dataset Splits

• —Alpaca: 3,225 examples
• —Unified Controls: 797 examples
• —Framework Mappings: 2,167 examples
• —Assessment Questions: 261 examples

• —ChatML: 3,072 examples
• —Unified Controls: 644 examples
• —Framework Mappings: 2,167 examples
• —Assessment Questions: 261 examples

Usage

Load with Hugging Face Datasets

from datasets import load_dataset

# Load Alpaca format
dataset = load_dataset("Zeezhu/grc-security-frameworks", "alpaca")

# Load ChatML format
dataset = load_dataset("Zeezhu/grc-security-frameworks", "chatml")

# Split into train/test
dataset = dataset['train'].train_test_split(test_size=0.1, seed=42)
train_data = dataset['train']
test_data = dataset['test']

Example Training Use Case

This dataset is ideal for:

• —Fine-tuning models for GRC advisory chatbots
• —Training compliance automation systems
• —Building security framework mapping tools
• —Creating assessment question generators
• —Developing control implementation assistants

Dataset Creation

Source Data

Original data extracted from official framework publications:

• —CIS Controls v8.1.2 (JSON)
• —CSA Cloud Controls Matrix v4.0.12 (JSON)
• —NIST SP 800-53 Rev 5 (OSCAL JSON)
• —NIST Cybersecurity Framework v2.0 (JSON)
• —NIST AI RMF Playbook v1.0 (JSON)

Processing Pipeline

1. 1.Extraction: Parsed official JSON/OSCAL files
2. 2.Normalization: Unified schema across frameworks
3. 3.Augmentation: Generated Q&A pairs and mappings
4. 4.Validation: Quality checks and format verification
5. 5.Formatting: Converted to Alpaca and ChatML formats

Quality Assurance

• —✅ 100% format validation
• —✅ No duplicates across datasets
• —✅ Consistent metadata tagging
• —✅ Source attribution for all examples
• —✅ Manual spot-checks of content accuracy

Content Categories

1. Unified Controls (644-797 examples)

Individual control explanations with:

• —Control ID and title
• —Full description
• —Implementation guidance
• —Asset type relevance
• —Security function mapping

2. Framework Mappings (2,167 examples)

Cross-framework relationships showing:

• —How controls map between frameworks
• —Related controls across standards
• —Equivalent requirements
• —Compliance alignment

3. Assessment Questions (261 examples)

Interview-style questions for:

• —Control implementation verification
• —Compliance gap analysis
• —Audit preparation
• —Risk assessment

Limitations

• —Dataset reflects framework versions as of generation date
• —Does not include proprietary or restricted frameworks
• —Focus on technical controls; limited governance/policy content
• —English language only
• —May not reflect latest framework updates after 2024

Ethical Considerations

• —Intended Use: Educational, compliance automation, GRC advisory systems
• —Misuse Risks: Should not replace professional security audits or legal compliance advice
• —Accuracy: While sourced from official frameworks, always verify critical compliance decisions
• —Bias: Reflects cybersecurity industry standards and may not cover all global regulations

Citation

If you use this dataset, please cite:

@dataset{grc_security_frameworks_2025,
  title={GRC Security Frameworks Dataset},
  author={Zeezhu},
  year={2025},
  publisher={Hugging Face},
  url={https://huggingface.co/datasets/Zeezhu/grc-security-frameworks}
}

License

This dataset is released under CC BY 4.0 (Creative Commons Attribution 4.0 International).

You are free to:

• —Share — copy and redistribute the material
• —Adapt — remix, transform, and build upon the material

Under the following terms:

• —Attribution — You must give appropriate credit

Framework Licenses

Source frameworks retain their original licenses:

• —CIS Controls: CIS Terms of Use
• —NIST publications: Public domain (U.S. Government work)
• —CSA CCM: Creative Commons Attribution 4.0

Contact

For questions, issues, or contributions:

• —Hugging Face: @Zeezhu
• —Dataset Repository: grc-security-frameworks

Version History

• —v1.0 (2025): Initial release
• —3,225 Alpaca examples
• —3,072 ChatML examples
• —5 major frameworks covered
• —644 unified controls
• —2,167 framework mappings
• —261 assessment questions

Acknowledgments

Special thanks to:

• —Center for Internet Security (CIS) for CIS Controls
• —Cloud Security Alliance (CSA) for CCM
• —National Institute of Standards and Technology (NIST) for SP 800-53, CSF, and AI RMF
• —The open-source compliance community