Ciso Assistant Community
Ciso Assistant Community is the free open-source GRC platform - 150+ frameworks, risk, audit, and compliance in one tool.
Last verified:
Visit Ciso Assistant Community
What is Ciso Assistant Community?
Ciso Assistant Community is the free, open-source edition of CISO Assistant, a one-stop-shop GRC (Governance, Risk, and Compliance) platform for cybersecurity program management. It consolidates governance, risk, compliance, and SecOps into a single tool with support for 150+ frameworks (ISO 27001, NIST CSF, SOC 2, PCI DSS, GDPR, NIS 2, DORA, AI Act, and more) and automatic mapping via the NIST OLIR standard. Includes risk assessment (ISO 27005, EBIOS RM), audit management, TPRM, incident tracking, vulnerability management, GDPR capture, and Jira integration. With 2.3M downloads and 4.1k GitHub stars it is the #1 open-source GRC project; AGPLv3 licensed, with paid PRO and Enterprise tiers for extras like SSO and advanced RBAC.
Ciso Assistant Community pricing
Pricing model: Freemium
CISO Assistant offers three tiers: (1) Community Plan - Free forever, open source AGPLv3 license, includes all GRC fundamentals, self-hosted via GitHub/Docker, unlimited readers up to 100 free. (2) PRO Plan - Available as SaaS (hosted in Europe by intuitem) or On-premises (deploy on your infrastructure). SaaS trial is 30 days free, no credit card required. You only pay for contributor seats (users with write permissions); readers are free up to 100. PRO features include: priority support (up to 3 contacts), managed SaaS hosting, installation assistance for on-prem, custom domain [6+ seats], IP filtering [6+ seats], Gantt timeline, impact analysis, custom branding, data import wizard, audit log [beta], smart inspector, domain analytics, campaigns management, fine-grained permissions, effort vs impact priority review, multi-level domain hierarchy, custom framework assistance [6+ seats], domain export, discount on training packages, and Customer Success Management [6+ seats]. (3) Enterprise Plan - Custom quotation-based, includes customization options, enterprise support plan, advanced SLA, managed backups & updates, air-gap compatible, dedicated customer success. For readers beyond 100, enterprise reader license package is required.
Ciso Assistant Community pros
- Open source with AGPLv3 license and community-audited code
- Free Community edition available forever
- 150+ cybersecurity frameworks included out of the box
- Automatic framework mapping using NIST OLIR standard
- Flexible deployment: cloud SaaS or on-premises
- All-in-one platform for governance, risk, compliance, and SecOps
- Readers are free up to 100 seats, pay only for contributor editors
- 30-day free trial for PRO plan with no credit card required
- Jira integration for remediation tracking and follow-up
- Private Gen AI with MCP integration ensuring data stays in your perimeter
- Full EBIOS RM support with all five ANSSI workshops
- Cyber Risk Quantification (CRQ) module with beginner-friendly presets
- Import/export capabilities to avoid vendor lock-in
- REST API and CLI for automation and integration
- 25 languages supported with active global community
- Gantt timeline for visualizing cybersecurity initiatives and milestones
- Custom branding with organization logo for PRO plan
- SSO support with SAML and OIDC for enterprise security
- Impact Analysis feature with interactive graph for control effectiveness
- Audit log for complete visibility and compliance accountability
- Data import wizard for Excel migration (Assets, Controls, Audits)
- Multi-level domain hierarchy for complex organizational structures
- Smart inspector for tracking requirements across all domains in one-click
- Campaigns management for multiple audits across frameworks simultaneously
Ciso Assistant Community cons
- Community edition lacks SSO and advanced RBAC features
- PRO plan requires payment for contributor seats (editors)
- Custom features and customization only available through enterprise quotation
- Standard support covers only business hours, not 24/7
- On-premises enterprise plan requires contacting sales for pricing
- Data import wizard is still in beta version
- Audit log feature is still in beta version
- Some advanced features like Customer Success Management require 6+ seats
- Custom domain and IP filtering require 6+ seats minimum
- Enterprise support plan needed for critical systems requiring advanced support
Frequently asked questions about Ciso Assistant Community
How does the pricing work?
You need seats only for contributors (editors) who have write permissions to input or change data, including reviews, comments, or approvals. Readers are free up to 100 readers. Beyond 100 readers, you need to switch to an enterprise plan for the readers' license package. Both SaaS and On-premises plans have unlimited options if you don't want to count contributor seats.
Is the community edition free forever?
Yes, the Community edition is free forever. It is open source under AGPLv3 license and includes all the GRC fundamentals. You can clone the repository and run it locally with Docker at no cost.
What is the support model?
The standard support plan covers business hours over a business week. For critical systems requiring advanced support, you need to reach out to the team for an enterprise plan. PRO plan includes priority support with fast-tracked inquiries and up to 3 support contacts.
What does Private Gen AI mean?
Private generative AI means you interact with models that are exclusive to your instance and run in private environments. These can be run in your infrastructure or the cloud instance and guarantee that your data never leaves your perimeter. MCP integration allows plugging Claude, GPT, Mistral, or locally hosted models for AI-assisted policy authoring, risk analysis, and chat without data exfiltration.
Can I move my data between environments?
Yes, with built-in data export and import capabilities, you can move your data between different instances, both cloud or on-premises. The Domain Export feature allows exporting all objects within a specific domain (controls, audits, evidences, risk assessments) in structured format for re-import into another instance.
What are the supported frameworks?
CISO Assistant has more than 150 cybersecurity frameworks including ISO 27001, ISO 27002, ISO 27005, ISO 22301, EBIOS RM, NIS 2, DORA, GDPR, NIST CSF, NIST SP 800-53, NIST SP 800-171, PCI DSS 4.0, SOC 2, CIS Controls, CRA, AI Act, TISAX, CMMC, MITRE ATT&CK, OWASP ASVS, and 100+ more. If an open and free standard or regulation is missing, the team will add it for free upon request.
What are the prerequisites to install CISO Assistant?
CISO Assistant consists of Docker images that can be installed on laptop, desktop, or server. If it can run Excel, it can run CISO Assistant. You need to install Docker and Docker-compose, then follow the instructions on GitHub. Other installation flavors are documented in the Docs section.
Can I add a custom/internal framework?
Yes, you can add custom frameworks by following the instructions on the documentation to use the open format. The platform supports custom frameworks with automated mapping. For complex and large framework integration, express consultancy options are available to assist.
I'm a solo consultant and don't want to pay for each one of my customers. How does this work?
You only pay for contributor seats since readers are free. As a solo consultant, you can use the same instance for multiple customers without paying per customer, as long as your customers are readers and not contributors who edit data.
What is the OSS license?
The open source license is AGPLv3 (Affero General Public License version 3). This means the code is open, audited by the community, and any organization can use the free Community edition. The open license also ensures open formats for framework management and data import/export.