CISO Assistant

Overview

CISO Assistant is a cybersecurity governance, risk and compliance platform for organizations that need to coordinate controls, assessments and remediation across a security program. It is best suited to teams with several frameworks or third-party reviews to manage; its strongest case is the breadth of work it brings together, while the choice between self-hosted, cloud and on-premises operation needs careful attention.

Key features

Frameworks and risk

The platform includes more than 150 frameworks, standards and regulations and lets teams create custom frameworks. Coverage includes NIS2, DORA, ISO 27001, SOC 2, GDPR, NIST CSF, HIPAA, CMMC, PCI DSS, ISO 22301, ISO 42001, TISAX and IEC 62443. Control mapping, evidence collection, risk assessments and remediation workflows connect framework requirements to ongoing work rather than leaving teams with a static checklist.

For risk analysis, CISO Assistant supports ISO 27005 and EBIOS RM, cyber risk quantification and business impact analysis. That makes it a fit for organizations that need both compliance tracking and a structured view of business exposure; teams looking only for a narrow audit workflow may not need this breadth.

Audits and suppliers

Audit campaigns, evidence management, findings tracking, audit logs and reminders support the work of preparing for and following up on audits. A dedicated third-party risk module adds supplier and partner evaluations, ownership assignment and remediation monitoring. Together, these functions can keep internal and external assurance work in the same system, though they also mean the platform is aimed at program-level coordination rather than a single-purpose policy repository.

Integrations, automation and access

Jira and ServiceNow integrations cover ticketing and asset synchronization; Kafka supports event streaming, and outgoing webhooks provide another route for events. A REST API and CLI allow operational automation, while MCP supports connections to compatible AI assistants or agents. SAML and OIDC single sign-on, role-based access control and multi-factor authentication are supported; SCIM provisioning is reserved for Pro.

Deployment and security

Pro is offered as SaaS or on-premises. On-premises installations can run inside a customer perimeter, including air-gapped environments, which is valuable where cloud access is unsuitable but makes deployment and operations an organizational responsibility. The vendor says SaaS tenants have isolated application instances and separate storage volumes, with TLS 1.3 in transit and disk-level encryption at rest. Intuitem says its security program aligns with NIST CSF and OWASP ASVS, uses ISO 27001-certified hosting providers and includes annual independent penetration testing.

Pricing

The Community edition costs nothing, billed forever. It is self-hosted, allows unlimited users and comes with community support under AGPLv3. It is the clearest fit for teams comfortable running the software themselves and relying on community help; it gives up Pro priority support and Pro-only SCIM provisioning.

Pro SaaS costs €39 a month, billed annually, per contributor. It includes 100 readers and 10 GB of storage, with an unlimited-seat option. This structure suits small teams seeking hosted service, but contributor-based pricing and storage should be checked against the number of active editors and evidence volume. A Storage Bundle adds 100 GB for €960 a year.

Pro On-premises costs €2,400 a year, billed annually, per instance, for 1–5 seats at the listed price; volume discounts are offered. It is aimed at mid-sized and large teams, but the listed base range is small, so larger deployments should establish their seat cost before committing. Unlimited Seats SaaS costs €8,500 a year and includes unlimited users with standard compute resources. SecNumCloud Instance - Unlimited costs €14,500 a year for unlimited users, SecNumCloud-certified hosting and a dedicated node. Custom pricing is available per quote for specific deployment needs, customization, proprietary framework integration and professional services.

A free 30-day cloud trial requires no credit card, and trial data can be migrated to production. That offers a practical way to assess the hosted workflow before choosing a plan.

Platforms

CISO Assistant supports API, Linux, self-hosted and web use. Pro SaaS provides a hosted route, while Pro on-premises supports perimeter-contained and air-gapped deployments.

Who it's for

It is a strong candidate for security and compliance teams managing multiple frameworks, risk methodologies, audits and supplier assessments together. Small teams can start with Pro SaaS, while organizations with strict infrastructure boundaries can consider on-premises deployment. A team that needs only one framework or a basic policy library may find the scope and deployment choices more than it needs.

Pros and cons

• Pro: More than 150 frameworks plus custom-framework support can reduce the need to split compliance work across separate systems.
• Pro: Risk, audit and third-party assessment workflows sit alongside evidence and remediation tracking, supporting program-wide oversight.
• Pro: Self-hosted Community and air-gapped-capable on-premises options suit teams that need infrastructure control.
• Con: Community users receive community support, while priority support is part of Pro; teams needing vendor assistance must budget for a paid plan.
• Con: Pro SaaS charges per contributor and includes 10 GB storage, so editing headcount and evidence growth can affect the fit.
• Con: The on-premises listed price covers only 1–5 seats per instance, requiring larger teams to account for volume pricing.

Alternatives

For a more explicitly open-source Community edition, ComplianceOS is described as MIT-licensed and includes 30+ frameworks and 1000+ pre-built controls; it is a narrower framework count than CISO Assistant's stated coverage.

OpenGRC is another freemium, self-hosted option, with full source code access and community support in its free Community plan. Consider it when source access is the deciding requirement.

Strike Graph offers a free Launch plan centered on SOC 2 security TSC, limited policy templates and specified cloud-platform/document combinations; it may suit a team focused on that starting scope.

ComplianceBridge Policy Management is a paid option for readers comparing policy-management software across mobile and desktop platforms.

Drata is a paid alternative with a GRC Foundation plan for up to 50 FTEs and one pre-mapped framework, plus Trust Center Standard and Open API Access; it suits teams whose needs match that defined starting package.

Mitratech CaseCloud is a paid option with personalized demos for buyers evaluating case management.

NAVEX EthicsPoint Incident Management is a paid web and mobile option for readers considering incident management.

Unicis is another freemium web option.

For broader comparisons, browse Compliance Management Software and Governance, Risk and Compliance Software.

Verdict

CISO Assistant is the right choice for security teams that want framework compliance, risk, audits and supplier assessments managed in one cybersecurity GRC platform, particularly when self-hosting or air-gapped deployment matters. Its breadth and deployment range are the main reasons to choose it; contributor-based SaaS pricing, storage limits and the small on-premises base seat range are reasons to compare the plan details before scaling.