CISO Assistant

Overview

The platform combines cybersecurity program management with compliance, risk assessment, audit and third-party workflows. More than 150 frameworks, standards and regulations are included, and teams can add custom frameworks. This breadth can make it useful as a shared workspace across a security program; organizations seeking only a narrow checklist or audit tool may find it more than they need.

Community is self-hosted and free, while Pro is offered as SaaS or on-premises. Pro SaaS is positioned for small teams, and Pro on-premises for mid-sized and large teams. The on-premises option can run inside a customer perimeter, including air-gapped environments, which matters to organizations with strict hosting constraints.

For broader comparisons, see Compliance Management Software and Governance, Risk and Compliance Software.

Key features

Frameworks, controls and risk

CISO Assistant covers frameworks including NIS2, DORA, ISO 27001, SOC 2, GDPR, NIST CSF, HIPAA, CMMC, PCI DSS, ISO 27005, EBIOS RM, ISO 22301, ISO 42001, TISAX and IEC 62443. Control mapping, evidence collection, risk assessments and remediation workflows connect requirements to ongoing program work. Custom frameworks extend that approach when a team needs to work against its own structure.

Risk management supports ISO 27005 and EBIOS RM, cyber risk quantification and business impact analysis. That combination suits teams that need to connect compliance activity to business exposure, rather than treating frameworks as standalone checklists.

Audits and supplier reviews

Audit campaigns, evidence management, findings tracking, audit logs and reminders support preparation and follow-up. The dedicated supplier and partner module adds evaluations, ownership assignment and remediation monitoring, a practical advantage for teams managing third-party risk alongside internal controls.

Integrations and access

Jira and ServiceNow are listed for ticketing and asset synchronization; Kafka supports event streaming, and outgoing webhooks provide another integration path. A REST API and CLI support automation, while MCP can connect compatible AI assistants or agents. SAML and OIDC single sign-on, role-based access control and multi-factor authentication are supported; SCIM provisioning is reserved for Pro.

Hosting and security

The vendor says SaaS tenants use isolated application instances and separate storage volumes, with TLS 1.3 in transit and disk-level encryption at rest. Intuitem says its security program aligns with NIST CSF and OWASP ASVS, uses ISO 27001-certified hosting providers and includes annual independent penetration testing. These measures may suit security-conscious buyers, while organizations requiring control of the hosting perimeter can choose on-premises Pro.

Pricing

The pricing model is freemium. Community costs 0.00 EUR per free, billed forever, and is self-hosted with unlimited users and community support under AGPLv3. It is a meaningful no-cost starting point, but it does not include Pro priority support or Pro-only SCIM provisioning.

Pro SaaS costs 39.00 EUR per month, billed annually, per contributor. It includes 100 readers and 10 GB of storage, with an unlimited-seat option. A Storage Bundle adds 100 GB for 960.00 EUR per year. The contributor-based charge and annual billing are important considerations as teams grow; customer success management is listed from six seats.

Pro On-premises costs 2400.00 EUR per year, billed annually, per instance, at the listed price for 1–5 seats; volume discounts are available. For larger SaaS deployments, Unlimited Seats SaaS costs 8500.00 EUR per year and includes standard compute resources. SecNumCloud Instance - Unlimited costs 14500.00 EUR per year for unlimited users, certified hosting and a dedicated node. Custom pricing is by quote for specific deployment needs, customization, proprietary framework integration or professional services.

A free 30-day cloud trial requires no credit card, and trial data can be migrated to production. That makes it possible to assess the cloud workflow before committing, though paid subscriptions are billed annually.

Platforms

CISO Assistant supports API, Linux, self-hosted and web environments. Pro SaaS is hosted by the vendor; Pro on-premises provides customer-controlled deployment, including air-gapped operation. The Community edition is self-hosted, so it is not the choice for teams seeking a managed free cloud plan.

Who it's for

CISO Assistant is a strong fit for security and compliance teams coordinating multiple frameworks, risk methods, audits and supplier assessments. Pro SaaS aligns with small teams wanting a managed service, while Pro on-premises better fits mid-sized and large teams that need to keep the system inside their perimeter. Community suits organizations able to self-host and rely on community support. Teams needing only one simple compliance workflow, or unwilling to manage self-hosting or annual paid plans, should compare narrower or differently priced options.

Pros and cons

• Pros: More than 150 frameworks plus custom-framework support help teams consolidate varied compliance work.
• Pros: Risk, audit and supplier workflows live in the same platform, reducing the need to separate these program activities.
• Pros: Free Community has unlimited users, and the 30-day cloud trial does not require a credit card.
• Pros: SaaS, on-premises and air-gapped deployment options accommodate different hosting constraints.
• Cons: Community is self-hosted and limited to community support, so it asks more of teams than a managed free service.
• Cons: Pro SaaS is billed annually and charges per contributor; storage beyond the included 10 GB requires an additional paid bundle.
• Cons: SCIM provisioning is a Pro feature, and the listed on-premises price covers only 1–5 seats.

Alternatives

ComplianceOS is worth considering for teams seeking a free, open-source Community edition under the MIT license, with 30+ frameworks and 1000+ pre-built controls; CISO Assistant instead offers a broader set of more than 150 frameworks and custom-framework support.

Riskonnect is a paid web, iOS and Android alternative for buyers comparing mobile platform availability.

OpenGRC offers a free self-hosted Community edition with full source code access and community support; it may suit teams prioritizing source access in a free GRC tool.

VComply is a paid web and Android option with plans that include onboarding sessions.

Drata is a paid alternative with a free trial, API and desktop platform support; its GRC Foundation plan includes up to 50 FTEs and one pre-mapped framework.

IsoMetrix is a paid web, iOS and Android alternative.

Unicis is a freemium web alternative.

TeamLease RegTech is a paid web, iOS and Android alternative.

Verdict

Choose CISO Assistant if your team needs one platform for framework-based compliance, risk, audits and supplier assessments, especially when self-hosted or air-gapped deployment matters. Its free unlimited-user Community edition lowers the barrier to start, and Pro adds managed SaaS or on-premises choices. Look elsewhere if you need a managed free plan, want to avoid annual per-contributor SaaS billing, or only need a narrow compliance workflow.