CISO Assistant: GRC Without the Excel Graveyard

In most companies, GRC lives in Excel: one sheet for the risk register, one per audit, one for the measures, all in different versions, all sent around by email, none of them current. CISO Assistant sets out to replace exactly that: an open-source platform that brings governance, risk and compliance together in one data model, self-hosted, with no licence costs.

In short: CISO Assistant is an open-source GRC platform by the French company intuitem. It connects compliance assessments against over 100 frameworks, a risk register, measures and evidence in one data model. The community edition runs via Docker on your own server; SSO and advanced reports are available in the Pro version.

What it is

CISO Assistant is developed by the French company intuitem and is freely available on GitHub. The project is young but growing fast, and over 3,600 stars and 80+ contributors (as of August 2026) speak for themselves. The community edition covers the core: assessments, risk register, measure management, evidence. If you need SSO or advanced reports, there is a Pro version.

It installs in minutes: one docker compose up and the platform runs locally or on your own server. For a tool that by its nature contains sensitive data (vulnerabilities, risks, audit findings), self-hosted is not a nice-to-have but an argument.

From scattered spreadsheet chaos to a shared data model. The real win is not the tool but the single shared source of truth.

Who it suits and who it does not

CISO Assistant fits when a company has to seriously demonstrate at least one framework (ISO 27001, NIS2, nDSG measures, a large customer questionnaire) and struggles with spreadsheets today. It also fits when data must stay in-house for confidentiality reasons. It fits less well when nobody has time to run the tool: a Docker host wants to be patched, the database backed up, the update applied. And it does not fit when all you really need is a risk register with five entries, because the platform is too heavy for that. If you want to see the alternatives, Open-source GRC tools compared puts four candidates side by side.

Why not Excel?

Excel does not fail at GRC because it is too weak, but because compliance work consists of relationships: a risk hangs off an asset, one measure mitigates several risks, a piece of evidence supports a measure, a framework requirement references all of it. In spreadsheets every one of those relationships is copied by hand and outdated by the next audit. In CISO Assistant they are references: change a measure, and every assessment that depends on it sees it.

The strongest feature: framework mapping

The platform ships with over 100 frameworks, among them ISO 27001, NIS2, DORA, NIST CSF, CIS Controls, BSI IT-Grundschutz and many more. The mapping is where it gets interesting: a measure documented for ISO 27001 automatically counts towards the corresponding NIS2 or SOC 2 requirements. If you have to serve several frameworks, you answer questions once instead of three times.

Document once, prove several times: the mapping connects one measure with the requirements of multiple frameworks.

The terms you need to know

The data model is the reason the tool works, and the reason getting started is bumpy. The most important terms:

• Domain: the organisational frame, usually the company or a business unit. Permissions are granted per domain.
• Perimeter: the scope of a piece of evidence: which sites, systems and processes an assessment covers.
• Framework: the catalogue of requirements, e.g. ISO 27001:2022 with its requirements.
• Compliance Assessment: the evaluation of a perimeter against a framework, requirement by requirement, with implementation status.
• Reference Control: a generic measure from a catalogue (“multi-factor authentication”).
• Applied Control: the concrete implementation in your own house (“MFA for all M365 accounts via Conditional Access, since March”).
• Evidence: the proof for a measure: screenshot, export, log.
• Risk Scenario: an entry in the risk register with likelihood, impact and the measures that mitigate it.

Whoever has understood these eight terms understands the tool.

Five steps to the first assessment

1. Create a domain and assign the users with their roles: who reads, who assesses, who approves.
2. Define the perimeter: what belongs in scope? For an SME usually the whole company; for an ISO certification exactly what should appear on the certificate.
3. Import a framework. The library ships the catalogues, one click is enough.
4. Start an assessment and record the implementation status requirement by requirement: not assessed, not implemented, partially, implemented, not applicable.
5. Link measures and evidence. From here the assessment becomes a programme: every gap gets an Applied Control with an owner and a deadline, every proof a piece of evidence.

Progress is visible at any time, as a number and not a gut feeling. And at the next audit the status is not “somewhere in the sheet” but one click away.

Operations: what comes after the first start

docker compose up is the beginning, not the end. For productive operation four things belong with it:

• HTTPS via a reverse proxy (Caddy, Traefik, nginx) with a real certificate, since the platform manages confidential data and does not belong on the network unencrypted.
• Backups of the database volume, regular and tested. A GRC tool without a backup is an Excel graveyard with a detour.
• Updates at short intervals: the project releases frequently, and framework libraries are extended continuously.
• Access only from the company network or via VPN. Even if the login is secure, the interface does not have to be public.

What a first quarter might look like

A realistic start for an SME working with spreadsheets today:

1. Month 1: inventory. Domain, perimeter, one framework (usually ISO 27001 or the most important customer questionnaire). Assess the whole thing honestly once, without embellishment.
2. Month 2: measures. An Applied Control with an owner and a deadline for every gap. Migrate existing Excel measures once, then switch the spreadsheet off.
3. Month 3: evidence and risks. Back the ten most important measures with proof, start the risk register with the five biggest scenarios. From now on the dashboard shows progress and management gets numbers instead of prose.

What it costs and what it does not

The community edition is free, and it stays free with many users: there is no per-seat limit. What costs money is operation (a small virtual server for 20 to 40 francs a month is enough for an SME) and the time for onboarding and maintenance. Counting honestly, that is two to four working days in the first year for setup and migration, then one to two hours a week for ongoing upkeep. The Pro version with SSO, advanced reports and support is available on request; for most environments under a hundred employees it is not necessary. For comparison: the commercial GRC suites that solve the same tasks typically start in the high four-figure range per year and end well above it. The difference is not the function but who does the work: with the suite the vendor, with open source yourself.

Staying honest: the limits

The learning curve is real. The data model is powerful, but you have to work through the vocabulary, and the documentation helps, but does not replace getting familiar with it. Operation needs someone who has Docker, backups and updates under control; the community edition comes without SSO, which is quickly missed in larger environments. And: a GRC tool does not create governance. If you do not know your risks, afterwards you have merely managed them more prettily. And a tool does not replace a budget either: what security may cost overall is what the security budget check shows as a guide value.

For small and mid-sized environments that struggle with spreadsheets today and may need to prove NIS2 or ISO requirements tomorrow, CISO Assistant is, in my view, one of the most exciting candidates in the open-source space.