What does heyGRC look for?
Not a fixed checklist. heyGRC reads the pull request for compliance-relevant changes against the frameworks you configured, and cites the clause.
What does heyGRC look for in a pull request?
Not bugs. Compliance-relevant changes: diffs that would matter in an audit. There is no fixed checklist. heyGRC reads the pull request against the frameworks you selected and the company context you gave it, then names the control a change touches.
The change families:
- Access control and authorization (roles, permissions, admin paths)
- Authentication (MFA, sessions, credential handling)
- Logging, monitoring, audit trails, and how long they are kept
- Data handling: new PII fields, exports, masking, deletion
- Encryption in transit and at rest, key handling
- Secrets and credentials in code or config
- Vendors and third parties: new SDKs, subprocessors, outbound data flows
- Retention and deletion rules
- Audit evidence: approvals, CI gates, migrations
For ISO 27001:2022 those families land mostly on A.5.15 to A.5.18, A.8.2 to A.8.5, A.8.15 and A.8.16, A.8.24, A.5.19 to A.5.23, A.8.10 to A.8.12, and A.5.33. SOC 2 is mostly CC6 and CC7.
Severity is the compliance risk of merging the PR as-is. A PR that improves a control gets a note in the summary, not a finding.
The public list, with the ISO and SOC 2 mapping: What compliance-relevant changes look like.