CISO Assistant
intuitem.com
What it is
CISO Assistant is a governance, risk, and compliance platform for managing cybersecurity programs. It brings together more than 150 frameworks, standards, and regulations, with support for custom frameworks. Risk work can use ISO 27005 and EBIOS RM methods, cyber risk quantification, and business impact analysis. Audit tools cover campaigns, evidence, findings, logs, and reminders; a separate module handles supplier and partner evaluations, assigned ownership, and remediation monitoring. Jira and ServiceNow integrations support ticketing and asset synchronization, alongside Kafka event streaming and outgoing webhooks. The product also offers a REST API, CLI, and MCP support for compatible AI assistants or agents. Community is free, self-hosted, and unlimited-user. Pro is available as SaaS or on-premises, with SaaS starting at €39/mo (annual). A free 30-day cloud trial requires no credit card. Platforms listed include API, Linux, self-hosted, and web.
Spec sheet
- What it does
- CISO Assistant is a governance, risk and compliance platform covering cybersecurity program management, audits, risk, compliance and operational work.Read 15 Oct 2026 · intuitem.com
- Purpose
- CISO Assistant is a GRC platform for cybersecurity program management, risk, and compliance.Read 29 Sep 2026 · intuitem.com
- Intended users
- The vendor describes Pro SaaS as suited to small teams and Pro on-premises as suitable for mid-sized and large teams.Read 29 Sep 2026 · intuitem.com
- Deployment
- Self-hosting uses Docker and Docker Compose, with Kubernetes deployment available through a Helm chart.Read 15 Oct 2026 · github.com
- Trial
- The vendor offers a free 30-day cloud trial with no credit card required, and says trial data can be migrated to production.Read 29 Sep 2026 · intuitem.com
- Integrations
- Officially listed integrations include Jira, ServiceNow, Kafka, outgoing webhooks, REST API, CLI and MCP.Read 15 Oct 2026 · intuitem.com
- Support
- Community includes community support; Pro subscriptions include priority support, with customer success management listed from six seats.Read 29 Sep 2026 · intuitem.com
- License
- The community edition is licensed under AGPLv3; the public GitHub repository identifies AGPL-3.0 licensing.Read 15 Oct 2026 · github.com
- Headquarters
- Vélizy-Villacoublay, FranceRead 23 Sep 2026 · intuitem.com
- API and extensibility
- The interface is API-first with REST CRUD coverage, personal access tokens, interactive API documentation in development mode, a CLI and MCP support.Read 15 Oct 2026 · intuitem.com
- Audit and evidence
- Users can run audit campaigns, collect evidence, track findings, maintain audit logs and schedule evidence reminders.Read 15 Oct 2026 · intuitem.com
- Automatic mapping
- Its mapping engine links controls to requirements across multiple frameworks so one assessment can support several standards.Read 15 Oct 2026 · intuitem.com
- Automation
- The product provides a REST API and CLI, and supports MCP for connecting compatible AI assistants or agents.Read 29 Sep 2026 · intuitem.com
- Certification status
- Intuitem says its security program aligns with NIST CSF and OWASP ASVS, uses ISO 27001-certified hosting providers and targets its own ISO 27001 certification for Q4 2026.Read 15 Oct 2026 · intuitem.com
- Cloud security
- The vendor says SaaS tenants use dedicated isolated application instances and separate storage volumes, with TLS 1.3 in transit and disk-level encryption at rest.Read 29 Sep 2026 · intuitem.com
- Company facts
- LinkedIn lists Intuitem as a privately held IT services and software company founded in 2018 with 11-50 employees and headquarters in Vélizy-Villacoublay, France.Read 15 Oct 2026 · linkedin.com
- Data portability
- Import and export functions allow moving data between cloud and on-premises instances, including CSV or Excel risk imports in Pro.Read 15 Oct 2026 · intuitem.com
- Database and storage
- SQLite is the default database, PostgreSQL is recommended for production, and attachments can use local storage, S3-compatible storage or Azure Blob.Read 15 Oct 2026 · intuitem.com
- Documentation depth
- The documentation site covers concepts, installation, configuration, features, guides, REST API, MCP, integrations and contributing.Read 15 Oct 2026 · intuitem.gitbook.io
- Framework coverage
- The product includes more than 150 built-in frameworks and supports custom frameworks.Read 15 Oct 2026 · intuitem.com
- Frameworks
- It includes more than 150 cybersecurity frameworks, standards, and regulations, and supports custom frameworks.Read 29 Sep 2026 · intuitem.com
- Identity and access
- The product supports SAML and OIDC single sign-on, role-based access control, and multi-factor authentication; SCIM provisioning is a Pro feature.Read 29 Sep 2026 · intuitem.com
- Identity controls
- The platform provides RBAC, SAML and OIDC SSO, TOTP or hardware-key MFA, and SCIM provisioning in Pro.Read 15 Oct 2026 · intuitem.com
- Independent deployment assessment
- Help Net Security reported Docker as the primary deployment path, with data remaining in the organization's own environment for the community edition.Read 15 Oct 2026 · helpnetsecurity.com
- Independent feature assessment
- Help Net Security highlighted linked assets, risks, controls and frameworks, custom controls, recurring assessments, APIs, n8n, MCP and Kafka integrations.Read 15 Oct 2026 · helpnetsecurity.com
- Independent product review
- Cybersec Chronicles reported support for audits, risk analysis, more than 70 frameworks at the time of its article, Jira ticketing, REST API, local AI, TPRM, BIA, GDPR processing records and CRQ.Read 15 Oct 2026 · cybersec-chronicles.com
- Independent technical assessment
- Hysenlabs described the project as API-first and self-hostable but said users should tolerate a large Python codebase and verify framework mappings themselves.Read 15 Oct 2026 · hysenlabs.com
- Legal entity
- The maker identifies itself in its site footer as intuitem SARL, registered in France with a €100,000 share capital and Versailles registry details.Read 15 Oct 2026 · intuitem.com
- Limit: bulk import
- The LinkedIn reviewer said stronger bulk-import capabilities would be useful.Read 15 Oct 2026 · linkedin.com
- Limit: framework freshness
- A Reddit tester questioned whether frameworks, particularly NIS2, are always kept current and noted that manual gap-filling may still be needed.Read 15 Oct 2026 · reddit.com
- Limit: maintenance effort
- A Reddit discussion warned that self-hosted open-source GRC tools require setup and ongoing maintenance that can distract teams without dedicated staff.Read 15 Oct 2026 · reddit.com
- Limit: user experience and setup
- The LinkedIn review identified the user interface and self-hosted installation process as areas that could be improved.Read 15 Oct 2026 · linkedin.com
- Notable news: documentation
- Intuitem announced a documentation restructuring to separate concepts from guides, version documentation with the code and accept community contributions.Read 15 Oct 2026 · intuitem.com
- Praise: dashboards
- The same reviewer said dashboards and graphs provide a clear high-level view for security teams, auditors and management.Read 15 Oct 2026 · linkedin.com
- Praise: framework mapping
- A LinkedIn reviewer praised the linked model between policies, risks, controls and assets, along with preloaded frameworks and mapping visualization.Read 15 Oct 2026 · linkedin.com
- Praise: value and usability
- Reddit users described the free open-source edition as surprisingly solid and decent after learning the system.Read 15 Oct 2026 · reddit.com
- Rating on G2
- 0.0 out of 5 from 0 reviews.Read 15 Oct 2026 · g2.com
- Risk management
- Native capabilities include ISO 27005 and EBIOS RM assessments, risk registers, treatment plans, business-impact analysis and cyber-risk quantification.Read 15 Oct 2026 · intuitem.com
- Security assurance
- Intuitem says its security program aligns with NIST CSF and OWASP ASVS, uses ISO 27001 certified hosting providers, and includes annual independent penetration testing.Read 29 Sep 2026 · intuitem.com
- Security hosting
- The SaaS service runs primarily in France across Scaleway and OVH, with a Netherlands disaster-recovery region and isolated customer instances.Read 15 Oct 2026 · intuitem.com
- Security practices
- The security plan states TLS 1.3 in transit, AES-256-equivalent encryption at rest, MFA for privileged access, vulnerability scanning and annual independent penetration testing.Read 15 Oct 2026 · intuitem.com
- System prerequisites
- The maker says installation requires Docker and Docker Compose and can run on a laptop, desktop or server; Windows uses Docker Desktop with WSL2.Read 15 Oct 2026 · github.com
- Third-party risk
- The TPRM module supports vendor questionnaires, assigned ownership, remediation monitoring and a vendor due-diligence baseline.Read 15 Oct 2026 · intuitem.com
Plans and prices
Community Free forever Self-hosted · unlimited users · essential features · community support · AGPLv3 Read 15 Oct 2026 · intuitem.com
Pro SaaS €39 a month Billed annually Per contributor · priority support · premium features · managed hosting, updates and backups · 10 GB storage · 100 readers included Read 15 Oct 2026 · intuitem.com
Storage Bundle €960 a year Annual +100 GB storage · snapshots support Read 15 Oct 2026 · intuitem.com
Pro On-premises €2,400 a year Billed annually Per instance · 1-5 contributor seats · priority support · premium features · deployment assistance Read 15 Oct 2026 · intuitem.com
Unlimited Seats SaaS €8,500 a year Annual Unlimited users · standard compute resources Read 15 Oct 2026 · intuitem.com
SecNumCloud Instance - Unlimited €14,500 a year Annual Unlimited users · SecNumCloud-certified hosting · dedicated node Read 15 Oct 2026 · intuitem.com
Custom Priced on request Per quote Specific deployment · customisation · proprietary frameworks · GRC coaching · professional services Read 15 Oct 2026 · intuitem.com
Strong points and limits
Strong points
- Includes more than 150 frameworks and supports custom ones
- Supports cyber risk quantification and business impact analysis
- Audit campaigns include evidence management and findings tracking
- Offers REST API, CLI, and MCP support
- Free 30-day cloud trial needs no credit card
Limits
- SCIM provisioning is a Pro feature
- Community includes community support
- Pro SaaS pricing is per contributor
- Pro on-premises runs on a per-instance basis
Who it suits
The vendor describes Pro SaaS as suited to small teams and Pro on-premises as suitable for mid-sized and large teams. Community may suit users seeking a free, self-hosted option with unlimited users.
CISO Assistant in depth
Read the full write-up
Overview
CISO Assistant is a cybersecurity GRC platform for organizations coordinating compliance, risk and audit work across multiple frameworks. It suits teams that want those activities alongside supplier assessments in one system, especially when self-hosting or on-premises deployment matters. Its breadth is a strength, but choosing it well means weighing deployment and seat terms as carefully as the feature set.
Key features
Frameworks and risk
The platform covers more than 150 frameworks, standards and regulations, with support for custom frameworks and control mapping. Its supported examples range from NIS2, DORA, ISO 27001 and SOC 2 to GDPR, HIPAA, CMMC, PCI DSS, ISO 42001 and IEC 62443. That breadth helps teams handle overlapping obligations in one place rather than maintain separate compliance trackers.
Risk work includes ISO 27005 and EBIOS RM methodologies, cyber risk quantification and business impact analysis. Evidence collection and remediation workflows connect assessment results to follow-up work. This combination is useful for teams managing an ongoing security program; organizations needing only a single-framework checklist may find the wider GRC scope unnecessary.
Audits and third parties
Audit campaigns, evidence management, findings tracking, audit logs and reminders cover both preparation and follow-through. A dedicated supplier and partner module adds evaluations, ownership assignment and remediation monitoring. Those capabilities make the product relevant beyond internal compliance, though they also mean it is more than a lightweight audit tracker.
Integrations and administration
Jira and ServiceNow support ticketing and asset synchronization; Kafka handles event streaming, and outgoing webhooks extend event handoffs. A REST API and CLI support automation, while MCP can connect compatible AI assistants or agents. SAML and OIDC single sign-on, role-based access control and multifactor authentication address access management; SCIM provisioning is reserved for Pro.
Pricing
The free Community plan costs nothing, billed forever. It is self-hosted, allows unlimited users and includes community support under AGPLv3. That is a meaningful option for organizations able to operate the software themselves, but it does not include Pro priority support or Pro-only SCIM provisioning.
Pro SaaS starts at €39 a month, billed annually, per contributor, with 100 readers included, 10 GB storage and an unlimited-seat option. This is the vendor's fit for small teams, but the per-contributor basis and storage allowance matter as participation and evidence volumes grow. A Storage Bundle adds 100 GB for €960 a year.
Pro On-premises costs €2,400 a year, billed annually, per instance, at the listed price for 1–5 seats; volume discounts are offered. It suits organizations that need deployment inside their own perimeter, including air-gapped environments, but the entry price covers a narrow seat band. Unlimited Seats SaaS costs €8,500 a year for unlimited users and standard compute resources. SecNumCloud Instance - Unlimited costs €14,500 a year for unlimited users on a dedicated node with SecNumCloud certified hosting.
Custom pricing is per quote for specific deployment needs, customization, proprietary framework integration or professional services. A free 30-day cloud trial requires no credit card, and trial data can be migrated to production, making it easier to evaluate SaaS before committing.
Platforms
CISO Assistant supports web and API access, Linux and self-hosted deployment. Pro is offered as SaaS or on-premises. The vendor says SaaS tenants use isolated application instances and separate storage volumes, with TLS 1.3 in transit and disk-level encryption at rest. Its security program aligns with NIST CSF and OWASP ASVS, uses ISO 27001-certified hosting providers and includes annual independent penetration testing.
Who it's for
Pro SaaS is positioned for small teams; Pro on-premises is aimed at mid-sized and large teams. The Community plan is a stronger fit for organizations comfortable self-hosting and relying on community support. Teams that need cloud convenience, priority support or SCIM should consider Pro, while organizations with strict perimeter or air-gap requirements have an on-premises route. Customer success management is listed from six seats.
Pros and cons
Pro: More than 150 frameworks plus custom-framework support, control mapping and risk methods let teams address varied compliance and risk work together.
Pro: Self-hosted Community is free forever with unlimited users, while Pro offers SaaS and on-premises choices, including air-gapped operation.
Pro: Audit follow-up and supplier remediation are included alongside assessments, extending the platform beyond framework tracking.
Con: SaaS pricing is per contributor, and the included 10 GB storage may require an additional annual storage bundle as evidence accumulates.
Con: On-premises pricing starts at an instance covering 1–5 seats; larger deployments may need volume pricing or a different tier.
Con: Community support is the free plan's support level, and SCIM is a Pro feature.
Alternatives
ComplianceOS is worth considering for teams seeking a self-hosted, open-source community edition under MIT with 30+ frameworks and 1000+ pre-built controls. Choose CISO Assistant instead when its broader framework coverage, risk methods or audit and supplier workflows are the priority.
Drata is a paid option with no free plan; its GRC Foundation tier covers up to 50 FTEs, one pre-mapped framework, a Trust Center Standard and Open API Access. It may suit buyers whose needs fit that defined package; CISO Assistant has a free self-hosted option and broader stated framework coverage.
Strike Graph offers a free Launch plan focused on SOC 2 security TSC, limited policy templates and specified cloud environments paired with Microsoft Office or Google Drive. It is a narrower starting point for that scope; CISO Assistant covers a wider set of frameworks and risk work.
ComplianceBridge Policy Management is a paid policy-management alternative for readers comparing policy-focused software.
OpenGRC has a free self-hosted Community plan with full source code access and community support, and an Enterprise Basic plan at $4,500 a year. Consider it when source-code access and a self-hosted GRC option are central to the decision.
Mitratech CaseCloud is another paid option to consider for readers comparing alternatives.
Intelex Inspection Management has a Safety Essentials plan at $44 a year with a 25-user minimum and incident management with near-miss reporting. It is a better match for that safety-management need than a broad cybersecurity GRC program.
NAVEX EthicsPoint Incident Management is a paid incident-management alternative with pricing tailored to organization size, program needs and selected solutions.
For broader comparisons, see Compliance Management Software and Governance, Risk and Compliance Software.
Verdict
CISO Assistant is a strong choice for teams that need framework coverage, risk analysis, audit follow-up and supplier assessment together, particularly when self-hosting or perimeter-controlled deployment matters. Its free unlimited-user Community plan is compelling for capable operators, while Pro offers clearer support and deployment choices. Look elsewhere if your needs are narrow or if per-contributor SaaS costs, storage limits or the 1–5-seat on-premises entry do not fit your team.
Verdict
CISO Assistant combines framework-based compliance work with risk, audit, and third-party assessment tools. Its free self-hosted Community plan and SaaS or on-premises Pro options offer different deployment and support choices.
Where Specifiction places it
- Compliance Management Software#1 of 519.4
- Governance, Risk and Compliance Software#1 of 369.3
- Security Management software#1 of 209.3
