The Gemara model

Everything in this registry implements Gemara, an OpenSSF project. In its own words, Gemara provides a logical model to describe the categories of compliance activities, how they interact, and the schemas to enable automated interoperability between them. GRC here means Governance, Risk, and Compliance — the functions organizations use to manage regulatory requirements, operational risk, and internal controls.

The point is interoperability: when a control catalog, a risk register, and an evaluation result all follow one model and schema, tools can hand work off to each other without bespoke glue.

The seven layers

Gemara organizes GRC work into seven layers, each producing artifacts that feed the next:

1. Vectors & Guidance — foundational knowledge or regulations.
2. Threats & Controls — technology-specific objectives.
3. Risk & Policy — organization-specific rules.
4. Sensitive Activities — actions that might introduce risk.
5. Intent & Behavior Evaluation — inspection of sensitive activities.
6. Preventive & Remediative Enforcement — corrective actions for noncompliance.
7. Audit & Continuous Monitoring — efficacy review of all previous outputs.

The artifacts in this registry live mostly in Layers 1–2 — the documents that define vectors, guidance, threats, capabilities, and controls. Evaluators operate at Layer 5 (Intent & Behavior Evaluation), turning those documents into checks.

Model, schema, SDK

Gemara ships as three things: the model (the conceptual layers above), the schemas (machine-readable formats that make artifacts interoperable), and SDKs for building tools against them. This registry stores and serves artifacts that conform to those schemas.