Gemara: GRC Engineering Model for Automated Risk Assessment | OpenSSF Project Spotlight

Why It Matters

By unifying GRC data across the software supply chain, Jamara lets organizations achieve continuous compliance and faster risk mitigation, translating into lower audit costs and stronger security postures.

Key Takeaways

• Jamara provides a multi‑layer logical model for GRC automation.
• Structured schemas eliminate data silos across security, compliance, and audit tools.
• Six conceptual layers map controls from policy to continuous audit evidence.
• Jamara integrates with OSCAL, exporting catalogs and profiles for interoperability.
• Community invites contributions via bi‑weekly meetings, Slack, and first‑issue tasks.

Summary

Jamara, the GRC Engineering Model for Automated Risk Assessment, is an OpenSSF‑hosted open‑source project that defines a multi‑layer logical model for integrating governance, risk, and compliance (GRC) directly into software engineering pipelines. Its purpose is to replace fragmented, tool‑specific data formats with a unified schema that enables seamless, automated risk assessment without creating new data silos.

The model outlines six conceptual layers—from high‑level policy guidance such as PCI‑DSS, through threat‑informed control definition, risk‑informed policy, environment and code evaluation, to enforcement and audit evidence collection. By standardizing inputs and outputs at each stage, Jamara makes the entire security‑control lifecycle traceable and interoperable, allowing continuous compliance loops that were previously impossible with disparate tools.

Jamara distinguishes itself from existing standards by focusing on the operational perspective of practitioners rather than the regulator’s view. It complements the NIST OSCAL framework; the Jamara Go library can export its schemas to OSCAL catalogs and profiles, and it already powers real‑world use cases such as the OpenSSF‑OSSP baseline and Finno’s common cloud controls catalog. The Privateer tool demonstrates automated evaluation against these exported catalogs, providing concrete audit logs.

The project’s open‑source nature invites community participation through bi‑weekly meetings, Slack, and beginner‑friendly issues, positioning it for rapid iteration and broad adoption. For enterprises, Jamara promises reduced compliance overhead, faster risk detection, and the ability to embed security controls directly into CI/CD workflows, ultimately accelerating product delivery while maintaining robust governance.

Original Description

Gemara (GRC Engineering Model for Automated Risk Assessment) provides a logical model to describe the categories of compliance activities, how they interact, and the schemas to enable automated interoperability between them.

In order to better facilitate cross-functional communication, the Gemara Model seeks to outline the categorical layers of activities related to automated governance.

Gemara delivers three core components that work together to support automated GRC: The Model, The Schemas, and The SDKs. Learn more at gemara.openssf.org/

This video features insights from Gemara maintainer:

• Jenn Power, Product Security Engineer at Red Hat