CISO Assistant offers a fresh perspective on Cybersecurity Management and GRC (Governance, Risk, and Compliance) practices:
- Designed as a central hub to connect multiple cybersecurity concepts with smart linking between objects,
- Built as a multi-paradigm tool that adapts to different backgrounds, methodologies, and expectations,
- Explicitly decouples compliance from cybersecurity controls, enabling reusability across the platform.
- Promotes reusability and interlinking instead of redundant work,
- Developed with an API-first approach to support both UI interaction and external automation,
- Comes packed with a wide range of built-in standards, security controls, and threat libraries,
- Offers an open format to customize and reuse your own objects and frameworks,
- Includes built-in risk assessment and remediation tracking workflows,
- Supports custom frameworks via a simple syntax and flexible tooling,
- Provides rich import/export capabilities across various channels and formats (UI, CLI, Kafka, reports, etc.).
Features
Upcoming features are listed on the roadmap.
CISO Assistant is developed and maintained by Intuitem, a company specializing in Cybersecurity, Cloud, and Data/AI.
Core Concepts
Here’s an extract of some of the building blocks in CISO Assistant to illustrate the decoupling concept that encourages reusability:
System architecture
Supported frameworks
ISO 27001:2013 & 27001:2022 🌐
- NIST Cyber Security Framework (CSF) v1.1 🇺🇸
- NIST Cyber Security Framework (CSF) v2.0 🇺🇸
- NIS2 🇪🇺
- SOC2 🇺🇸
- PCI DSS 4.0.1 💳
- CMMC v2 🇺🇸
- PSPF 🇦🇺
- General Data Protection Regulation (GDPR): Full text and checklist from GDPR.EU 🇪🇺
- Essential Eight 🇦🇺
- NYDFS 500 with 2023-11 amendments 🇺🇸
- DORA (Act, RTS, ITS and GL) 🇪🇺
- NIST AI Risk Management Framework 🇺🇸🤖
- NIST SP 800-53 rev5 🇺🇸
- France LPM/OIV rules 🇫🇷
- CCB CyberFundamentals Framework 🇧🇪
- NIST SP-800-66 (HIPAA) 🏥
- HDS/HDH 🇫🇷
- OWASP Application Security Verification Standard (ASVS) 4 🐝🖥️
- RGS v2.0 🇫🇷
- AirCyber ✈️🌐
- Cyber Resilience Act (CRA) 🇪🇺
- TIBER-EU 🇪🇺
- NIST Privacy Framework 🇺🇸
- TISAX (VDA ISA) v5.1 and v6.0 🚘
- ANSSI hygiene guide 🇫🇷
- Essential Cybersecurity Controls (ECC) 🇸🇦
- CIS Controls v8* 🌐
- CSA CCM (Cloud Controls Matrix)* ☁️
- FADP (Federal Act on Data Protection) 🇨🇭
- NIST SP 800-171 rev2 (2021) 🇺🇸
- ANSSI : recommandations de sécurité pour un système d’IA générative 🇫🇷🤖
- NIST SP 800-218: Secure Software Development Framework (SSDF) 🖥️
- GSA FedRAMP rev5 ☁️🇺🇸
- Cadre Conformité Cyber France (3CF) v1 (2021) ✈️🇫🇷
- ANSSI : SecNumCloud ☁️🇫🇷
- Cadre Conformité Cyber France (3CF) v2 (2024) ✈️🇫🇷
- ANSSI : outil d’autoévaluation de gestion de crise cyber 💥🇫🇷
- BSI: IT-Grundschutz-Kompendium 🇩🇪
- NIST SP 800-171 rev3 (2024) 🇺🇸
- ENISA: 5G Security Controls Matrix 🇪🇺
- OWASP Mobile Application Security Verification Standard (MASVS) 🐝📱
- Agile Security Framework (ASF) – baseline – by intuitem 🤗
- ISO 27001:2013 🌐 (For legacy and migration)
- EU AI Act 🇪🇺🤖
- FBI CJIS 🇺🇸👮
- Operational Technology Cybersecurity Controls (OTCC) 🇸🇦
- Secure Controls Framework (SCF) 🇺🇸🌐
- NCSC Cyber Assessment Framework (CAF) 🇬🇧
- California Consumer Privacy Act (CCPA) 🇺🇸
- California Consumer Privacy Act Regulations 🇺🇸
- NCSC Cyber Essentials 🇬🇧
- Directive Nationale de la Sécurité des Systèmes d’Information (DNSSI) Maroc 🇲🇦
- Part-IS ✈️🇪🇺
- ENS Esquema Nacional de seguridad 🇪🇸
- Korea ISA ISMS-P 🇰🇷
- Swiss ICT minimum standard 🇨🇭
- Adobe Common Controls Framework (CCF) v5 🌐
- BSI Cloud Computing Compliance Criteria Catalogue (C5) 🇩🇪
- Référentiel d’Audit de la Sécurité des Systèmes d’Information, ANCS Tunisie 🇹🇳
- ECB Cyber resilience oversight expectations for financial market infrastructures 🇪🇺
- Mindeststandard-des-BSI-zur-Nutzung-externer-Cloud-Dienste (Version 2.1) 🇩🇪
- Formulaire d’évaluation de la maturité – niveau fondamental (DGA) 🇫🇷
- NIS2 technical and methodological requirements 2024/2690 🇪🇺
- Saudi Arabian Monetary Authority (SAMA) Cybersecurity Framework 🇸🇦
- Guide de sécurité des données (CNIL) 🇫🇷
- International Traffic in Arms Regulations (ITAR) 🇺🇸
- Federal Trade Commission (FTC) Standards for Safeguarding Customer Information 🇺🇸
- OWASP’s checklist for LLM governance and security 🌐
- Recommandations pour les architectures des systèmes d’information sensibles ou à diffusion restreinte (ANSSI) 🇫🇷
- CIS benchmark for Kubernetes v1.10 🌐
- De tekniske minimumskrav for statslige myndigheder 🇩🇰
- Google SAIF framework 🤖
- Recommandations relatives à l’administration sécurisée des SI (ANSSI) 🇫🇷
- Prudential Standard CPS 230 – Operational Risk Management (APRA) 🇦🇺
- Prudential Standard CPS 234 – Information Security (APRA) 🇦🇺
- Vehicle Cyber Security Audit (VCSA) v1.1 🚘
- Cisco Cloud Controls Framework (CCF) v3.0 ☁️🌐
- FINMA – Circular 2023/01 – Operational risks and resilience – Banks 🇨🇭
- Post-Quantum Cryptography (PQC) Migration Roadmap (May 2025) 🔐
- Cloud Sovereignty Framework – 1.2.1 – Oct 2025 🇪🇺
- ISO 22301:2019 outline – Business continuity management systems 🌐
- CCB CyberFundamentals Framework 2025 🇧🇪
- Prestataires de détection des incidents de sécurité (PDIS) – Référentiel d’exigences 🇫🇷
- Vendor Due Diligence – simple baseline – intuitem 🌐
- Points de contrôle Active Directory (AD) – ANSSI 🇫🇷
- ISO 42001:2023 outline – Artificial Intelligence Management System, including Annex A 🤖🌐
- India’s Digital Personal Data Protection Act (DPDPA) – 2023 🇮🇳
- E-ITS (Estonia’s national cyber security standard) – 2024 🇪🇪
- Microsoft cloud security benchmark v1 – ☁️🌐
- Baseline informatiebeveiliging Overheid 2 (BIO2) 🇳🇱
- ANSSI : Questionnaire MonAideCyber 🇫🇷
- ITSP.10.171 – Protecting specified information in non-Government of Canada systems and organizations 🇨🇦
- CISA Vendor Supply Chain Risk Management (SCRM) Template 🇺🇸
- European Sustainability Reporting Standards (ESRS) 🇪🇺
- ITIL 4 Management Practices 🌐
- NOREA – DORA in Control Framework v3.0 🇪🇺
- NIS-1 transposition FR 🇫🇷
- PSSI État 🇫🇷
- Checklist de dossier d’homologation 🇫🇷
- Cahier des charges Label EBIOS RM v3.1 🇫🇷
- SecNumCloud v3.2 Annexe 2 : recommandations aux commanditaires ☁️🇫🇷
- CCB CyberFundamentals Small – Self assessment 🇧🇪
- Mitre ATT&CK v18.1 – Threat catalog 🌐
- Mitre D3FEND – Reference controls 🌐
- OWASP Top 10 Web – Threat catalog 🐝🌐
- OWASP MAS Threat Modelling Guide – Threat catalog 🐝📱
- CISA Cybersecurity Performance Goals (CPG) v2.0 🇺🇸
- ANSSI : Référentiel Cyber France pour la réglmentation NIS2 (ReCyF) 🇫🇷
