Delve
AI-native compliance automation with agent-based evidence collection
CISO Assistant
Unified GRC platform decoupling compliance from cybersecurity controls
CISO Assistant is a multi-paradigm GRC platform that decouples compliance from security controls, enabling reusability, smart linking, and automation across 35+ built-in frameworks.
Overview
Modern GRC for Cybersecurity Teams
CISO Assistant reimagines Governance, Risk, and Compliance (GRC) by decoupling compliance tracking from cybersecurity controls. This separation enables teams to reuse assessments across multiple frameworks, evaluate a single scope against several standards simultaneously, and eliminate redundant data entry. Built with an API-first architecture, the platform supports both UI-driven workflows and external automation.
Built-In Standards and Flexibility
The platform ships with 35+ pre-loaded frameworks—including ISO 27001, NIST CSF, NIS2, SOC2, PCI DSS, GDPR, and CMMC—alongside integrated risk assessment and remediation tracking workflows. An open format allows teams to import custom frameworks using simple syntax, while rich import/export capabilities span UI, CLI, Kafka, and report generation.
Designed for Practitioners
Developed by Intuitem, CISO Assistant addresses tool fragmentation and data duplication challenges faced by cybersecurity and IT professionals. Its multi-paradigm design adapts to diverse methodologies, and smart object linking creates a central hub that promotes interoperability and simplification. Self-hosting options via Docker and a cloud SaaS trial make deployment straightforward for teams of any size.
Highlights
Decouples compliance from controls for cross-framework reusability
35+ built-in standards (ISO 27001, NIST CSF, NIS2, SOC2, GDPR, PCI DSS)
API-first architecture with UI, CLI, and Kafka integration
Built-in risk assessment and remediation tracking workflows
Pros
- Eliminates redundant assessments by reusing controls across frameworks
- API-first design enables deep automation and external integrations
- Extensive library of pre-loaded compliance frameworks and threat libraries
- Self-hosting via Docker or cloud SaaS trial for flexible deployment
Considerations
- Multi-paradigm approach may require onboarding time for new users
- Main branch can have breaking changes; production use requires stable tags
- Advanced customization demands familiarity with open format syntax
- Community-driven roadmap means feature priorities depend on user input
Managed products teams compare with
When teams consider CISO Assistant, these hosted platforms usually appear on the same shortlist.
Looking for a hosted option? These are the services engineering teams benchmark against before choosing open source.
Fit guide
Great for
- Organizations managing compliance across multiple frameworks simultaneously
- Security teams seeking to automate GRC workflows via API integrations
- CISOs needing centralized risk assessment and remediation tracking
- Teams wanting to self-host or customize compliance frameworks
Not ideal when
- Teams requiring fully managed, white-glove GRC consulting services
- Organizations with no technical capacity for Docker or API integration
- Users expecting a single-framework, wizard-driven compliance tool
- Environments where open-source tooling is prohibited by policy
How teams use it
Multi-Framework Compliance Mapping
Evaluate a single security scope against ISO 27001, NIST CSF, and NIS2 simultaneously, reusing control assessments to reduce audit preparation time by 60%.
Automated Risk Remediation Tracking
Integrate CISO Assistant APIs with ticketing systems to automatically sync remediation tasks, ensuring real-time visibility into control implementation status.
Custom Framework Import for Industry Standards
Import proprietary or sector-specific frameworks using the open format, enabling compliance tracking for internal policies alongside public standards.
Centralized GRC Hub for Distributed Teams
Provide a single source of truth for cybersecurity controls, risk assessments, and compliance evidence across global offices, reducing data duplication and inconsistencies.
Tech snapshot
Python53%
Svelte21%
TypeScript14%
HTML10%
Jinja1%
Shell1%
Frequently asked questions
What does 'decoupling compliance from controls' mean?
CISO Assistant separates control implementation from compliance tracking, so a single control can satisfy requirements across multiple frameworks without re-assessment.
Can I self-host CISO Assistant?
Yes. Use the provided Docker Compose scripts for self-hosting on your infrastructure, or try the cloud SaaS free trial for faster onboarding.
Which compliance frameworks are included?
35+ frameworks ship out-of-the-box, including ISO 27001, NIST CSF, NIS2, SOC2, PCI DSS, GDPR, CMMC, DORA, and Essential Eight. Custom frameworks can be imported.
How does the API-first architecture work?
All platform functions are accessible via REST APIs, enabling automation, CI/CD integration, and data exchange with external tools like SIEM, ticketing, or BI systems.
Is CISO Assistant suitable for small teams?
Yes. The Docker deployment is lightweight, and the decoupling model reduces manual work, making it practical for teams of any size managing one or more frameworks.
Project at a glance
Active- Stars
- 3,514
- Watchers
- 3,514
- Forks
- 583
Repo age2 years old
Last commit19 hours ago
Self-hostingSupported
Primary languagePython
Last synced 12 hours ago