OpenSSF Releases Japanese Version of GRC Engineering Model 'Gemara' for Automated Risk Assessment

OpenSSF Release - Japanese Version of the GRC Engineering Model 'Gemara' for Automated Risk Assessment

The Japanese version of 'Gemara: A Governance, Risk, and Compliance Engineering Model for Automated Risk Assessment', published by the Open Source Security Foundation (OpenSSF), has been released. Gemara is an OpenSSF model that transforms governance, risk, and compliance (GRC) activities into standardized, machine-readable engineering methods.

Download available here:

Japanese version: Gemara: A Governance, Risk, and Compliance Engineering Model for Automated Risk Assessment (Japanese)

Original version (English): Gemara: A Governance, Risk, and Compliance Engineering Model for Automated Risk Assessment

This paper introduces the Gemara model, a structure designed to classify compliance activities and define their functional interactions. Rather than describing organizational workflows or human processes, the model identifies the activities inherent in governance, along with their components and structural relationships. While these activities have long existed in practice, a unified engineering architecture with predictable exchange points has been lacking. By decomposing these activities into distinct layers, the model promotes documentation and standardization of terminology, establishing a foundation for the collaborative maintenance of shared resources.

Key Points

7-Layer Logical Model: Identifies governance-inherent activities, their components, and structural relationships.

Interoperable Data: Utilizes CUE-based schemas to enable security tools to seamlessly share data.

Engineering-First Design: Built for DevSecOps teams to handle Compliance as Code.

Why It Matters

Gemara bridges the gap between requirements (the desired state) and operational reality (what actually happened). Organizations can scale security monitoring without slowing down deployment, providing a common language for both auditors and engineers.

References

Explore schemas and SDKs on GitHub

Join the ORBIT Working Group

Learn about OpenSSF Membership

Japanese Translation Support: OpenSSF Japan Chapter Translation Team

Yuta Kiyomi (Honda R&D Co., Ltd.)

Non Kawana (Hitachi, Ltd.)

Takashi Shimosawa (Hitachi, Ltd.)

Hodatsu Yoh (Renesas Electronics Corporation)

Munehiro Ikeda (CyberTrust Japan Co., Ltd.)