2026.10.09
CISO Assistant: One GRC Workflow for Risk, Compliance, and Remediation
CISO Assistant brings risk, compliance, audit, and remediation workflows together. This overview covers its documented features, suitable users, self-hosting paths, license, and adoption caveats.
What it is for
CISO Assistant is an open-source GRC platform covering risk management, AppSec, compliance and audit, third-party risk, business impact analysis, privacy, and reporting. Its central idea is to decouple compliance requirements from security controls. In practice, that is intended to make assessments and control information reusable across scopes and frameworks instead of repeatedly entering the same data.
Image source: ciso-assistant-community. Published by the project; the interface may vary by version.
Who it may suit
The project is a potential fit for security and compliance teams, internal auditors, risk managers, and consultants handling several frameworks or recurring assessments. The README lists more than 220 included frameworks and names examples such as ISO 27001, NIST CSF, SOC 2, PCI DSS, NIS2, DORA, GDPR, HIPAA, and CMMC. Framework coverage should not be confused with achieved compliance: applicability, evidence quality, control implementation, and audit expectations still have to be managed by the organization.
Image source: ciso-assistant-community. Published by the project; the interface may vary by version.
Documented capabilities
The feature list includes audit and campaign management, automatic mapping, custom frameworks, policy, document, and evidence management. Risk functions include risk assessments and registers, EBIOS RM, threat modeling, risk acceptance workflows, business impact analysis, cyber risk quantification, vulnerability management, and risk projection. Other areas include third-party risk, contracts, remediation plans, findings, tasks, exceptions, incidents, approvals, dashboards, reports, and custom metrics.
For automation and integration, the README lists a REST API, CLI, Kafka, MCP, workflow automation, an import wizard, outgoing webhooks, and Jira and ServiceNow integrations. Access-related features include RBAC, SAML/OIDC SSO, TOTP and security-key MFA, SCIM provisioning, and audit logs. The v4.1.0 release notes add risk-review MCP write tools, EBIOS RM UI improvements, and CSV/XLSX export for third-party assessments.
Caveats before adoption
The repository page identifies the license as AGPL-3.0. Organizations should have legal counsel review obligations before modifying, integrating, or distributing the software. The README explicitly warns against using the main branch directly in production because development changes may be breaking; stable tags or prebuilt images should be evaluated instead. The supplied sources do not confirm minimum hardware, capacity, upgrade compatibility, security certification, or performance, so none should be assumed.
Deployment considerations
The project documents a Docker Compose quick-start path and also points to configuration tooling and Kubernetes Helm deployment. A self-hosting plan should cover persistent storage, backups and recovery, mail delivery, identity integration, logging, network isolation, upgrades, and rollback. Test imports, permissions, external integrations, and generated reports before production use. On Windows, the README calls for Docker Desktop with WSL2 and notes that some hosts may show image-platform mismatch warnings. Whether it is production-ready for a particular organization depends on operational ownership and version governance, not the feature list alone.
Sources
Sources checked: 2026-10-09