The largest open library of executable compliance policy anyone can verify: 13,758 control-level checks across 54 standards (CIS, DISA STIG, NIST, ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR, CCPA, EU AI Act, NERC-CIP, MAS, APRA, HKMA, DPDP) in OPA Rego, Apache 2.0, with the broadest regulatory coverage of any machine-readable policy library, open or closed.
13,758 control-level checks and 740 policy files at the current release, counted by
make count and re-verified by CI on every merge. Compared on 2026-10-12 against every public library we
could find — Azure Policy built-ins (5,130 definitions), ComplianceAsCode (2,574 rules), KICS (1,813),
Prowler (1,625), the Secure Controls Framework (1,534 catalogue controls, not executable) — this is the
largest set of executable compliance checks anyone can verify, and the only one that spans host benchmarks,
cloud, SaaS, Kubernetes, IaC, AI governance and regulators on four continents in one policy language.
The method and the numbers: docs/COMPARISON.md.
Largest in the world by raw rule count. Closed commercial libraries do not publish auditable counts and some are probably larger per-setting. We claim what can be checked.