What it is
An Entity Profile is a reusable template that shapes a GRC record to a particular methodology. Each profile defines two things for the entity it applies to:
- Field rules - which fields appear, which are required, and their defaults. You only capture the columns a given standard expects, rather than every possible field on every record.
- A status flow - the allowed lifecycle states and the permitted transitions between them, so a record moves through the stages that standard prescribes.
This is the same idea as ITIL Process Profiles, which shape Ops tasks to ITSM standards - generalized to the core GRC entities: risk, audit, change, and vendor. A risk register run to NIST 800-37 and one run to ISO 27005 want different fields and a different lifecycle; a profile captures that difference once, as a named, standard-tagged template, instead of hard-coding one shape for everyone.
Seeded standard templates
Each organization can seed a set of ready-made profiles drawn from common methodologies:
| Entity | Seeded profiles |
|---|---|
| Risk | NIST SP 800-37, ISO 27005 |
| Audit | SOC 2, ISO 27001 |
| Change | ITIL 4 |
| Vendor | SIG, VSA-Lite |
The seed is a starting point - you can edit a seeded profile's field rules and status flow, or create your own profile for an internal standard, and tag it with the source methodology so reviewers know what shape a record follows.
How a profile is applied
When a record is created or edited under a profile, the profile's field rules drive which fields are shown and required and what their defaults are, and the status flow constrains which state the record can move to next. The result is records that consistently match the standard your team is working to - the right fields, captured at the right stage - which is exactly what an assessor expects to see.
MCP tool reference
| Tool | Purpose |
|---|---|
list_entity_profiles | List the organization's entity profiles - name, entity type, source standard, and whether it is a built-in template. Optional entity-type filter (risk / audit / change / vendor). Auditor+. |
Related
- ITIL Process Profiles - the same idea applied to Ops tasks / ITSM
- GRC guide - the Risk Register, Audits, Change Control, and Vendor modules these profiles shape
- Entity templates - reusable starting-point records for the same entities
- MCP setup - connecting Claude Desktop / API to TATER