CISO Assistant: A GRC Platform That Maps 200+ Frameworks Without Locking You In

What CISO Assistant Actually Solves

CISO Assistant targets a specific pain: GRC tool fragmentation. Security teams often juggle separate tools for risk registers, compliance audits, third-party risk, and business impact analysis, which leads to duplicated data and inconsistent control definitions. The project's stated design principle is to decouple compliance from cybersecurity controls, meaning a single control can be reused across multiple frameworks instead of being recreated for each audit. This is aimed at practitioners who need a central hub that links concepts like threats, risks, and controls, rather than a static document store. The README claims support for over 200 frameworks, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, and CMMC. That breadth is the main draw for organizations that must comply with multiple regimes simultaneously. The platform is not a niche tool; it is positioned as a one-stop-shop, which is both its strength and its risk, as we will see.

The Architecture: API-First and Control-Centric

The underlying mechanism is an API-first design, which the README emphasizes as enabling both UI interaction and external automation. This means every action you perform in the web interface can be replicated through REST calls, which is critical for teams that want to integrate GRC into CI/CD pipelines or feed data from vulnerability scanners. The core data model revolves around objects that are smartly linked: risks, controls, frameworks, and audits are not siloed but connected, allowing automatic mapping between frameworks. For example, a control that satisfies an ISO 27001 requirement can also be mapped to a NIST CSF function, and that mapping is automatic rather than manual. The README mentions an open format for custom frameworks, with a simple syntax, so you are not forced to use only the built-in libraries. The platform also includes built-in workflows for risk assessment and remediation tracking, which suggests a state machine where risks go through assessment, acceptance, and action plan stages. The technical stack is Python, and the project uses a Docker-based deployment, which we will cover next.

Getting It Running: Docker Scripts and Config Builder

The quick start is straightforward but assumes Docker familiarity. You clone the repository with a single branch: `git clone --single-branch -b main https://github.com/intuitem/ciso-assistant-community.git`. Then you run a starter script: `./docker-compose.sh` on Linux or macOS, or `./docker-compose.ps1` on Windows with Docker Desktop and WSL2. The script uses prebuilt images that support most standard hardware architectures, but the README warns that if you see platform mismatch errors, you can use `docker-compose-build.sh` to build for your specific architecture. For more customization, there is a config builder in the `config/` directory and official documentation. A critical warning is that you should not use the `main` branch code directly for production because it is the merge upstream and can have breaking changes. The README advises using tags or prebuilt images for stable versions. This is a common pattern for active open-source projects, but it means you must be disciplined about version pinning. The docker-compose file can be adjusted for extra parameters like mailer settings, so you have some flexibility without deep code changes.

The Feature Set: Beyond Basic Compliance Tracking

The README lists 59 features in total, but the visible subset goes beyond simple checklist management. Compliance features include audit and campaigns management, automatic mapping, a mapping explorer, custom frameworks, policies management, document management, and evidence management. Risk management covers risk assessments and registers, an EBIOS RM module (a French risk method), risk acceptance workflows, Business Impact Analysis, cyber risk quantification, and vulnerability management with enrichment. There is also third-party risk management and action plan tracking for remediation. This is not a lightweight tool; it tries to cover the full GRC lifecycle. The inclusion of EBIOS RM and cyber risk quantification suggests a depth for risk practitioners, not just compliance officers. However, the README only gives feature names without detail on how quantification is calculated or how enrichment sources work. As a reviewer, I cannot verify the accuracy of the framework mappings or the quality of the risk models from the material alone. That is a limitation you must investigate before trusting the outputs.

A Genuine Limitation: The License Is Unclear

The most immediate red flag is the license field: NOASSERTION. That means the repository does not clearly declare a standard open-source license. The README calls it an open format and mentions a community edition, but without a license identifier like MIT or Apache 2.0, you cannot assume you have the right to modify, redistribute, or use the code commercially without asking. This is a genuine failure mode for adoption. If your legal team requires a standard license, this project may be a non-starter until the maintainers clarify. The README also points to a SaaS free trial at intuitem.com, which suggests a commercial entity behind the project, but that does not resolve the licensing ambiguity. Another limitation is the warning against using the main branch in production. This is not unusual, but combined with the license issue, it means you need to do extra diligence before deployment. Additionally, the platform's breadth means a steep learning curve; the README does not provide a quick-start tutorial beyond the Docker script, so you will likely need to consult the external documentation.

Alternatives: Comparing Approaches

A direct alternative is Eramba, an open-source GRC tool that also supports multiple frameworks but takes a different architectural approach. Eramba is built on CakePHP and uses a more traditional LAMP stack, whereas CISO Assistant is Python-based and API-first. The key difference is that Eramba's community edition is more limited in features compared to its enterprise edition, while CISO Assistant appears to offer a broader feature set in its community version, at least based on the README. Another alternative is the commercial platform Vanta or Drata, which are SaaS-only and focus heavily on continuous compliance automation, but they are not self-hostable and have a per-seat cost. The difference in approach is that Vanta integrates directly with your cloud providers and code repositories to collect evidence automatically, whereas CISO Assistant requires you to input or import data through its API or UI. If you need automated evidence collection from AWS or GitHub, CISO Assistant may not have that out of the box. If you need full control over your data and the ability to customize frameworks, CISO Assistant's open format and API-first design offer more flexibility than a closed SaaS.

Maintenance and Upgrade Cost

The project is actively maintained, with releases v4.0.1 on September 5, 2026, and v3.21.4 on September 1, 2026, indicating a rapid release cadence. This is a double-edged sword. Frequent releases mean bug fixes and new features, but they also mean you must keep up with upgrades to avoid falling behind on security patches or framework updates. The README warns that main branch can have breaking changes, so you should track release tags. The upgrade path is not documented in the README, but the use of Docker images suggests you can pull new images and migrate data, though you must verify database migrations. The project has CI badges for API tests and functional tests, which suggests a test suite, but I cannot confirm coverage. The cost of maintenance is not trivial: you need to monitor releases, test upgrades in a staging environment, and potentially deal with breaking changes. There is no mention of a dedicated upgrade script, so plan for manual steps. The documentation and Discord community are available, but that is not the same as vendor support unless you use the commercial SaaS.

Final Verdict: Who Should Adopt

CISO Assistant is a serious contender for organizations that want to consolidate GRC activities without paying for a commercial platform. Its API-first design and support for 200+ frameworks make it attractive for mid-sized security teams that need to map controls across ISO 27001 and SOC 2, for example. The automatic mapping feature could save significant manual effort. However, the NOASSERTION license is a dealbreaker for many enterprises, and the lack of detail on framework accuracy means you must validate mappings yourself. If you are a small team with Docker skills and a tolerance for open-source ambiguity, this could be a powerful tool. If you need guaranteed support, a clear license, or out-of-the-box integrations with cloud providers, look elsewhere. Before adopting, clone the repository, run the docker-compose script on a test server, import a sample framework, and check whether the mapping explorer shows the relationships you expect. Also, check the FOSSA status link in the README for dependency licensing, and contact the maintainers about the license. Only then can you decide if the octopus arms are a blessing or a tangle.

Editorial conclusion

Adopt CISO Assistant if you need a self-hostable, API-first GRC platform that centralizes risk, compliance, and audit workflows without paying per-seat licensing, and if you can tolerate the complexity of a large Python codebase and the need to verify framework mappings yourself. Do not adopt it if you want a turnkey SaaS with vendor support, or if you require a formal open-source license before deployment; the repository lists NOASSERTION, so you must clarify licensing with the maintainers. Before production use, verify that your required frameworks are accurately mapped in the current release, check the release tags for stability (avoid main branch), and test the docker-compose deployment on your target architecture, especially if you use ARM or other non-standard hardware. The project's active release cadence (v4.0.1 in September 2026) suggests ongoing maintenance, but you should still confirm the license and support model before committing.

Official sources

1. intuitem/ciso-assistant-community on GitHub
2. Issues
3. Project website
4. README
5. Releases