CISO Assistant

CISO Assistant is a governance, risk, and compliance platform for cybersecurity program management. Its library covers more than 150 frameworks, standards, and regulations, and teams can create custom frameworks. Risk work includes ISO 27005 and EBIOS RM methods, cyber risk quantification, and business impact analysis. Audit functions include campaigns, evidence management, finding tracking, logs, and reminders. A separate third-party risk module supports supplier and partner reviews, assigned ownership, and remediation monitoring. Listed connections include Jira and ServiceNow for ticketing and asset synchronization, Kafka event streaming, and outgoing webhooks. A REST API, CLI, and MCP support automation and connections to compatible AI assistants or agents. Community is free, self-hosted, and supports unlimited users. Pro is offered as SaaS or on-premises; Pro SaaS starts at €39/mo (annual), and a 30-day cloud trial does not require a credit card. On-premises deployments can run within a customer perimeter, including air-gapped environments.

CISO Assistant brings risk, audit, and supplier assessment workflows into one GRC platform. Teams can begin with Community or evaluate Pro through the cloud trial before selecting a deployment approach.

CISO Assistant suits teams managing cybersecurity risks, audits, and compliance obligations across established or custom frameworks. The vendor describes Pro SaaS for small teams and Pro on-premises for mid-sized and large teams.

CISO Assistant is a cybersecurity governance, risk and compliance platform for organizations coordinating controls, risk work, audits and supplier reviews. It best suits teams managing multiple frameworks or deployment requirements. Its breadth is a strength, but the choice between a free self-hosted edition and paid Pro deployments has real cost and operating implications.

Overview

The platform combines cybersecurity program management with compliance, risk assessment, audit and third-party workflows. More than 150 frameworks, standards and regulations are included, and teams can add custom frameworks. This breadth can make it useful as a shared workspace across a security program; organizations seeking only a narrow checklist or audit tool may find it more than they need.

Community is self-hosted and free, while Pro is offered as SaaS or on-premises. Pro SaaS is positioned for small teams, and Pro on-premises for mid-sized and large teams. The on-premises option can run inside a customer perimeter, including air-gapped environments, which matters to organizations with strict hosting constraints.

For broader comparisons, see Compliance Management Software and Governance, Risk and Compliance Software.

Key features

Frameworks, controls and risk

CISO Assistant covers frameworks including NIS2, DORA, ISO 27001, SOC 2, GDPR, NIST CSF, HIPAA, CMMC, PCI DSS, ISO 27005, EBIOS RM, ISO 22301, ISO 42001, TISAX and IEC 62443. Control mapping, evidence collection, risk assessments and remediation workflows connect requirements to ongoing program work. Custom frameworks extend that approach when a team needs to work against its own structure.

Risk management supports ISO 27005 and EBIOS RM, cyber risk quantification and business impact analysis. That combination suits teams that need to connect compliance activity to business exposure, rather than treating frameworks as standalone checklists.

Audits and supplier reviews

Audit campaigns, evidence management, findings tracking, audit logs and reminders support preparation and follow-up. The dedicated supplier and partner module adds evaluations, ownership assignment and remediation monitoring, a practical advantage for teams managing third-party risk alongside internal controls.

Integrations and access

Jira and ServiceNow are listed for ticketing and asset synchronization; Kafka supports event streaming, and outgoing webhooks provide another integration path. A REST API and CLI support automation, while MCP can connect compatible AI assistants or agents. SAML and OIDC single sign-on, role-based access control and multi-factor authentication are supported; SCIM provisioning is reserved for Pro.

Hosting and security

The vendor says SaaS tenants use isolated application instances and separate storage volumes, with TLS 1.3 in transit and disk-level encryption at rest. Intuitem says its security program aligns with NIST CSF and OWASP ASVS, uses ISO 27001-certified hosting providers and includes annual independent penetration testing. These measures may suit security-conscious buyers, while organizations requiring control of the hosting perimeter can choose on-premises Pro.

Pricing

The pricing model is freemium. Community costs nothing, billed forever, and is self-hosted with unlimited users and community support under AGPLv3. It is a meaningful no-cost starting point, but it does not include Pro priority support or Pro-only SCIM provisioning.

Pro SaaS costs €39 a month, billed annually, per contributor. It includes 100 readers and 10 GB of storage, with an unlimited-seat option. A Storage Bundle adds 100 GB for €960 a year. The contributor-based charge and annual billing are important considerations as teams grow; customer success management is listed from six seats.

Pro On-premises costs €2,400 a year, billed annually, per instance, at the listed price for 1–5 seats; volume discounts are available. For larger SaaS deployments, Unlimited Seats SaaS costs €8,500 a year and includes standard compute resources. SecNumCloud Instance - Unlimited costs €14,500 a year for unlimited users, certified hosting and a dedicated node. Custom pricing is by quote for specific deployment needs, customization, proprietary framework integration or professional services.

A free 30-day cloud trial requires no credit card, and trial data can be migrated to production. That makes it possible to assess the cloud workflow before committing, though paid subscriptions are billed annually.

Platforms

CISO Assistant supports API, Linux, self-hosted and web environments. Pro SaaS is hosted by the vendor; Pro on-premises provides customer-controlled deployment, including air-gapped operation. The Community edition is self-hosted, so it is not the choice for teams seeking a managed free cloud plan.

Who it's for

CISO Assistant is a strong fit for security and compliance teams coordinating multiple frameworks, risk methods, audits and supplier assessments. Pro SaaS aligns with small teams wanting a managed service, while Pro on-premises better fits mid-sized and large teams that need to keep the system inside their perimeter. Community suits organizations able to self-host and rely on community support. Teams needing only one simple compliance workflow, or unwilling to manage self-hosting or annual paid plans, should compare narrower or differently priced options.

Pros and cons

• Pros: More than 150 frameworks plus custom-framework support help teams consolidate varied compliance work.
• Pros: Risk, audit and supplier workflows live in the same platform, reducing the need to separate these program activities.
• Pros: Free Community has unlimited users, and the 30-day cloud trial does not require a credit card.
• Pros: SaaS, on-premises and air-gapped deployment options accommodate different hosting constraints.
• Cons: Community is self-hosted and limited to community support, so it asks more of teams than a managed free service.
• Cons: Pro SaaS is billed annually and charges per contributor; storage beyond the included 10 GB requires an additional paid bundle.
• Cons: SCIM provisioning is a Pro feature, and the listed on-premises price covers only 1–5 seats.

Alternatives

ComplianceOS is worth considering for teams seeking a free, open-source Community edition under the MIT license, with 30+ frameworks and 1000+ pre-built controls; CISO Assistant instead offers a broader set of more than 150 frameworks and custom-framework support.

Riskonnect is a paid web, iOS and Android alternative for buyers comparing mobile platform availability.

OpenGRC offers a free self-hosted Community edition with full source code access and community support; it may suit teams prioritizing source access in a free GRC tool.

VComply is a paid web and Android option with plans that include onboarding sessions.

Drata is a paid alternative with a free trial, API and desktop platform support; its GRC Foundation plan includes up to 50 FTEs and one pre-mapped framework.

IsoMetrix is a paid web, iOS and Android alternative.

Unicis is a freemium web alternative.

TeamLease RegTech is a paid web, iOS and Android alternative.

Verdict

Choose CISO Assistant if your team needs one platform for framework-based compliance, risk, audits and supplier assessments, especially when self-hosted or air-gapped deployment matters. Its free unlimited-user Community edition lowers the barrier to start, and Pro adds managed SaaS or on-premises choices. Look elsewhere if you need a managed free plan, want to avoid annual per-contributor SaaS billing, or only need a narrow compliance workflow.