An open-source, API-first GRC platform that unifies risk assessment, compliance mapping across 200+ frameworks, vulnerability tracking and incident workflows for authorized security teams.

CISO Assistant from intuitem positions itself as a one-stop-shop for cybersecurity governance, risk and compliance — the GRC layer that most offensive-security readers encounter from the other side of the table during audits and client engagements. The community repository (intuitem/ciso-assistant-community) sits at roughly 4,400 stars and is written primarily in Python, maintained by the company Intuitem with an active contributor base and visible CI badges for API and functional tests. What makes it relevant to a technically minded audience is not just the breadth of features but the architecture: it is explicitly API-first, decouples compliance requirements from actual security controls, and ships with an automation surface that includes a CLI, REST API, Kafka integration, outgoing webhooks, Jira and ServiceNow connectors, and even MCP support.

The core design principle the README keeps returning to is decoupling. Rather than binding each compliance requirement to a hard-coded control implementation, CISO Assistant separates the control layer from the framework layer, which means a single implemented control can satisfy requirements across ISO 27001, SOC2, NIST CSF, PCI DSS and dozens of other frameworks simultaneously. The practical consequence is that you can evaluate one scope against multiple frameworks at once, reuse past assessments across engagements, and let the platform's automatic mapping and consistency checks handle crosswalk work that consultants traditionally do in spreadsheets. A mapping explorer and a recommendations engine round out this layer, so coverage gaps and duplicated effort surface quickly.

Framework coverage is where the numbers get striking: over 200 frameworks are bundled, with the README enumerating more than 50 explicitly. These span the expected heavyweights — ISO 27001:2013 and :2022, NIST CSF v1.1 and v2.0, NIST SP 800-53 rev5, SOC2, PCI DSS 4.0.1, CMMC v2 — through regional and sector-specific regimes like NIS2, DORA, GDPR, TISAX, FedRAMP, the EU AI Act, BSI IT-Grundschutz, ANSSI guidance, NCSC CAF, and the CBB/ECC frameworks. There is even an Agile Security Framework (ASF) authored by Intuitem itself. For assessment teams working multi-jurisdiction engagements, this library alone eliminates a significant chunk of boilerplate preparation, and the open format for custom frameworks means internal policies or niche client standards can be loaded with a simple syntax rather than database surgery.

On the risk side, the feature list reads like a condensed risk-management practice: risk assessments and registers, a dedicated EBIOS RM module, threat modeling, risk acceptance workflows, Business Impact Analysis, Cyber Risk Quantification, and vulnerability management with enrichment and advisory feeds mapped to CWE and TTP catalogs. The inclusion of TTP catalogs is notable because it gives risk records a vocabulary familiar from adversary-emulation work, bridging the gap between threat-intel taxonomies and boardroom-facing risk language. Vulnerability findings can flow into the same remediation pipeline as compliance gaps, with action plan tracking, prioritization, Kanban boards, findings tracking, exceptions, and periodic checks keeping the loop closed.

Third-party risk gets first-class treatment rather than an afterthought module. The platform covers third-party risk management, contract management, the DORA register of information, and external security ratings, which reflects the regulatory direction in the EU financial sector where outsourced ICT risk is now under direct supervisory scrutiny. Incident management is likewise present with DORA incident reporting hooks and validation/approval flows, plus email reminders for overdue actions. For practitioners advising clients on NIS2 or DORA readiness, having the registers and reporting workflows built into the same tool that holds the risk register reduces the usual friction of stitching together three separate products.

The operational tooling deserves attention from an automation perspective. Beyond the UI, the platform exposes a comprehensive REST API (with published Swagger documentation), a CLI for scripted operations, a data import wizard, Kafka streaming, outgoing webhooks, and integrations into Jira and ServiceNow — the two ticketing systems where remediation tasks actually get worked in most enterprises. The import/export story includes consultant-oriented features like single-domain export/import, which is clearly aimed at firms that repeat similar assessments across clients and want to carry methodology without carrying client data. The topics list also flags LLM and MCP support, and the repository contains a local AI engine setup under backend/chat/, signaling that assistant-driven navigation over your own GRC data is a first-class roadmap item rather than a bolt-on.

Deployment is deliberately low-friction for evaluation. The recommended path is Docker with docker-compose, kicked off by the starter scripts docker-compose.sh on Linux/macOS or docker-compose.ps1 on Windows, using prebuilt images for common architectures. The README cautions against running the main branch in production since it is the upstream merge target and can break, steering operators toward release tags or the prebuilt images instead; a docker-compose-build.sh variant exists for building against unusual architectures. For fleet deployments, Kubernetes via Helm is supported, and a config builder under ./config/ covers more elaborate self-hosting setups, with the compose file accepting extras such as mailer settings. A hosted SaaS trial is also offered for teams that want to evaluate before committing infrastructure.

Access control and identity integration are enterprise-grade: flexible RBAC, SSO via SAML or OIDC, MFA with TOTP and hardware security keys, SCIM provisioning, and a full audit log. Multi-level domains let managed service providers or large organizations partition scopes, and portals plus a trust-center feature extend visibility to stakeholders outside the security team. The platform is localized into more than 26 languages, which matters for organizations whose evidence collection and policy attestations happen in languages other than English.

For an authorized security practice, where CISO Assistant earns its keep is consolidation. The README's framing — tool fragmentation, data duplication, lack of integration — matches what most assessors observe at clients: risk register in one tool, findings in a ticket queue, evidence in a shared drive, and compliance status in a slide deck. By modeling domains, scopes, assessments, controls and requirements as interlinked objects with an explicit data-model document under documentation/architecture/, the platform makes those connections queryable and reportable. Analytics dashboards, report generation, automated quality checks and custom metrics tracking then turn that graph into the deliverables stakeholders actually want.

From a defensive-operations standpoint, nothing here is offensive tooling; it is pure governance infrastructure. The telemetry consideration runs in the opposite direction from most tools covered on this blog: CISO Assistant becomes a concentration of sensitive information — risk registers, accepted risks, vulnerabilities, third-party assessments — which makes its own hardening relevant. The audit log, SSO enforcement, MFA and RBAC are therefore not checkbox features but the controls that determine whether standing this platform up improves your posture or creates a single juicy target for anyone who compromises an account with broad access.

Licensing is flagged as NOASSERTION by GitHub metadata, meaning it is not a standard OSI license string automatically detected — anyone planning commercial deployment should read the actual license terms before embedding it into a consulting product. Documentation lives in a GitBook, the roadmap is public, and there is an active Discord community alongside a Trendshift badge, all of which suggest sustained momentum rather than an abandoned dump. For security engineers asked to support an audit, stand up a risk program, or just escape spreadsheet-driven compliance, CISO Assistant is one of the more credible open-source options currently available, provided you deploy from stable tags and treat its API surface with the same care you would any other system holding a map of your organization's weaknesses.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.