ciso-assistant-community Documentation

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, Privacy, and Reporting.

3,964 stars Python Python 1 file · ~8,675 tokens #audit#automation#bsi#cis#compliance
RAW Doc

Docker & Self-Hosted Deployment Verified OCI

Deploy ciso-assistant-community on any server, homelab, or cloud container platform.

1-Click Terminal Command
bash (docker run) 
docker run -d --name ciso-assistant-community --restart always intuitem/ciso-assistant-community:latest
docker-compose.yml
yaml (docker-compose.yml) 
#Requires -Version 5.0

[CmdletBinding(PositionalBinding = $false)]
param(
    [Alias("f")]
    [string] $DockerComposeFile = "docker-compose-build.yml",

    [Parameter(ValueFromRemainingArguments = $true, DontShow = $true)]
    [string[]] $UnsupportedArguments = @()
)

$ErrorActionPreference = "Stop"
Set-StrictMode -Version Latest

$BackendCheckAttempts = 60
$BackendCheckDelaySeconds = 10

if ($UnsupportedArguments.Count -gt 0) {
    Write-Host "Unknown argument(s): $($UnsupportedArguments -join ', '). Supported arguments: -f ." -ForegroundColor Red
    exit 1
}

function Invoke-Checked {
    param(
        [Parameter(Mandatory = $true)]
        [string] $FilePath,

        [string[]] $Arguments = @()
    )

    & $FilePath @Arguments
    if ($LASTEXITCODE -ne 0) {
        throw "Command failed with exit code ${LASTEXITCODE}: $FilePath $($Arguments -join ' ')"
    }
}

function Invoke-DockerCompose {
    param(
        [Parameter(ValueFromRemainingArguments = $true)]
        [string[]] $Arguments
    )

    $composeArguments = @("compose", "-f", $DockerComposeFile) + $Arguments
    Invoke-Checked -FilePath "docker" -Arguments $composeArguments
}

function Prepare-MetaFile {
    $version = (& git describe --tags --always)
    if ($LASTEXITCODE -ne 0) {
        throw "Unable to determine CISO Assistant version with git describe."
    }

    $build = (& git rev-parse --short HEAD)
    if ($LASTEXITCODE -ne 0) {
        throw "Unable to determine CISO Assistant build with git rev-parse."
    }

    $meta = "CISO_ASSISTANT_VERSION=$version`nCISO_ASSISTANT_BUILD=$build`n"
    [System.IO.File]::WriteAllText((Join-Path (Get-Location) ".meta"), $meta, [System.Text.Encoding]::ASCII)
    Copy-Item -Path ".meta" -Destination ".\backend\ciso_assistant\.meta" -Force
    Copy-Item -Path ".meta" -Destination ".\backend\.meta" -Force
}

function Wait-ForBackend {
    for ($i = 1; $i -le $BackendCheckAttempts; $i++) {
        & docker compose -f $DockerComposeFile exec -T backend curl --fail --silent http://localhost:8000/api/health/ *> $null
        if ($LASTEXITCODE -eq 0) {
            Write-Host "Backend is ready!" -ForegroundColor Green
            return
        }

        if ($i -eq $BackendCheckAttempts) {
            $timeoutSeconds = $BackendCheckAttempts * $BackendCheckDelaySeconds
            Write-Host "Backend did not become ready within ${timeoutSeconds}s. Recent backend logs:" -ForegroundColor Red
            Invoke-DockerCompose logs --tail=50 backend
            exit 1
        }

        Start-Sleep -Seconds $BackendCheckDelaySeconds
    }
}

Push-Location $PSScriptRoot
try {
    if (-not (Test-Path -Path $DockerComposeFile -PathType Leaf)) {
        throw "Compose file not found: $DockerComposeFile"
    }

    if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
        throw "git was not found in PATH."
    }

    if (-not (Get-Command docker -ErrorAction SilentlyContinue)) {
        throw "docker was not found in PATH."
    }

    $env:DOCKER_BUILDKIT = "1"
    $env:COMPOSE_DOCKER_CLI_BUILD = "1"

    Write-Host "Using Docker Compose file: `"$DockerComposeFile`"" -ForegroundColor Cyan
    Write-Host ""

    if (Test-Path -Path "db\ciso-assistant.sqlite3" -PathType Leaf) {
        Write-Host "The database seems already created." -ForegroundColor Yellow
        Write-Host "For successive runs, you can now use `"docker compose -f $DockerComposeFile up`"." -ForegroundColor Yellow
        exit 0
    }

    Prepare-MetaFile

    Write-Host "Building containers..." -ForegroundColor Cyan
    Invoke-DockerCompose build --pull

    New-Item -Path ".\db" -ItemType Directory -Force | Out-Null

    Write-Host ""
    Write-Host "Starting services..." -ForegroundColor Cyan
    Invoke-DockerCompose up --detach

    Write-Host ""
    Write-Host "Waiting for CISO Assistant backend to be ready, please wait..." -ForegroundColor Cyan
    Wait-ForBackend

    Write-Host ""
    Write-Host "Initialize your superuser account..." -ForegroundColor Cyan
    # Keep TTY allocation for the interactive Django prompts in Windows terminals.
    Invoke-DockerCompose exec backend python manage.py createsuperuser

    Write-Host ""
    Write-Host "CISO Assistant is ready!" -ForegroundColor Green
    Write-Host "Connect to CISO Assistant on `"https://localhost:8443`"" -ForegroundColor Green
    Write-Host "For successive runs, you can now use `"docker compose -f $DockerComposeFile up`"" -ForegroundColor Green
    Write-Host "If the webpage doesn't load, please wait 2-3 minutes" -ForegroundColor Green
}
finally {
    Pop-Location
}


CISO Assistant offers a fresh perspective on Cybersecurity Management and GRC (Governance, Risk, and Compliance) practices:

  • Designed as a central hub to connect multiple cybersecurity concepts with smart linking between objects,
  • Built as a multi-paradigm tool that adapts to different backgrounds, methodologies, and expectations,
  • Explicitly decouples compliance from cybersecurity controls, enabling reusability across the platform,
  • Promotes reusability and interlinking instead of redundant work,
  • Developed with an API-first approach to support both UI interaction and external automation,
  • Comes packed with a wide range of built-in standards, security controls, and threat libraries,
  • Offers an open format to customize and reuse your own objects and frameworks,
  • Includes built-in risk assessment and remediation tracking workflows,
  • Supports custom frameworks via a simple syntax and flexible tooling,
  • Provides rich import/export capabilities across various channels and formats (UI, CLI, Kafka, reports, etc.).

Our vision is to create a one-stop-shop for cybersecurity management—modernizing GRC through simplification and interoperability.

As practitioners working with cybersecurity and IT professionals, we've faced the same issues: tool fragmentation, data duplication, and a lack of intuitive, integrated solutions. CISO Assistant was born from those lessons, and we're building a community around pragmatic, common-sense principles.

We’re constantly evolving with input from users and customers. Like an octopus 🐙, CISO Assistant keeps growing extra arms—bringing clarity, automation, and productivity to cybersecurity teams while reducing the effort of data input and output.





Quick Start 🚀

[!TIP]
The easiest way to get started is through the free trial of cloud instance available here.

Alternatively, once you have Docker and Docker-compose installed, on your workstation or server:

clone the repo:

sh
git clone --single-branch -b main https://github.com/intuitem/ciso-assistant-community.git

and run the starter script

sh
./docker-compose.sh     # Linux/MacOS
./docker-compose.ps1    # Windows

If you are looking for other installation options for self-hosting, check the config builder and the docs.

[!NOTE]
The docker-compose script uses prebuilt Docker images supporting most of the standard hardware architecture.
If you're using Windows, make sure to have Docker Desktop with WSL2 installed and trigger the PowerShell script. It will feed Docker Desktop on your behalf.

The docker compose file can be adjusted to pass extra parameters to suit your setup (e.g. Mailer settings).

[!WARNING]
If you're getting warnings or errors about image's platform not matching host platform, raise an issue with the details and we'll add it shortly after. You can also use docker-compose-build.sh instead (see below) to build for your specific architecture.

[!CAUTION]
Don't use the main branch code directly for production as it's the merge upstream and can have breaking changes during our development. Either use the tags for stable versions or prebuilt images.

Features

📋 Full feature list — click to expand (searchable, 59 features)

Compliance & frameworks

  • Audit and campaigns management
  • Automatic mapping
  • Mapping explorer
  • Custom frameworks supported
  • +167 frameworks included
  • Policies management
  • Document management
  • Evidence management

Risk management

  • Risk assessments and registers
  • EBIOS RM module
  • Risk acceptance workflows
  • Business Impact Analysis
  • Cyber Risk Quantification
  • Vulnerability management
  • Vulnerability enrichment

Third-party risk

  • Third-party risk management

Operations & remediation

  • Action plan tracking and prioritization
  • Findings tracking
  • Recommendations engine
  • Control plan
  • Task management
  • Kanban boards
  • Periodic checks
  • Technical posture management
  • Exceptions tracking
  • Incidents management
  • Validation & approval flows
  • Email reminders

Reporting & analytics

  • Analytics and dashboards
  • Reports generation
  • Automated quality checks
  • Advanced insights
  • Custom metrics tracking

Collaboration & productivity

  • Assignments & respondent mode
  • Comments & collaboration
  • Universal search
  • Command palette

Automation & integrations

  • Comprehensive REST API
  • CLI for automation
  • Data import wizard
  • Kafka integration
  • MCP support
  • Outgoing webhooks
  • Jira & ServiceNow integrations
  • Consultant features (e.g. single-domain export/import)

Security & access

  • Flexible RBAC
  • SSO with SAML or OIDC
  • MFA with TOTP and security keys
  • SCIM provisioning
  • Audit log

Privacy

  • GDPR processings

Programme management

  • Project management
  • Responsibility matrices

Platform

  • Portals & trust center
  • Custom fields
  • Multi-level domains
  • Kubernetes (Helm) deployment
  • Open Source
  • Available in +26 languages

Upcoming features are listed on the roadmap.

CISO Assistant is developed and maintained by Intuitem, a company specialized in Cybersecurity, Cloud, and Data/AI.

Core Concepts

Here’s an extract of some of the building blocks in CISO Assistant to illustrate the decoupling concept that encourages reusability:

For full details, check the data model documentation.

Decoupling Concept

At the heart of CISO Assistant lies the decoupling principle, which enables powerful use cases and major time savings:

  • Reuse past assessments across scopes or frameworks,
  • Evaluate a single scope against multiple frameworks simultaneously,
  • Let CISO Assistant handle reporting and consistency checks so you can focus on remediation,
  • Separate control implementation from compliance tracking.

Here is an illustration of the decoupling principle and its advantages:

https://github.com/user-attachments/assets/87bd4497-5cc2-4221-aeff-396f6b6ebe62

System architecture

End-user Documentation

Check out the online documentation on https://intuitem.gitbook.io/ciso-assistant.

Setting up the local AI engine

Read more here: AI engine

Supported frameworks 🐙

  1. ISO 27001:2013 & 27001:2022 🌐
  2. NIST Cyber Security Framework (CSF) v1.1 🇺🇸
  3. NIST Cyber Security Framework (CSF) v2.0 🇺🇸
  4. NIS2 🇪🇺
  5. SOC2 🇺🇸
  6. PCI DSS 4.0.1 💳
  7. CMMC v2 🇺🇸
  8. PSPF 🇦🇺
  9. General Data Protection Regulation (GDPR): Full text and checklist from GDPR.EU 🇪🇺
  10. Essential Eight 🇦🇺
  11. NYDFS 500 with 2023-11 amendments 🇺🇸
  12. DORA (Act, RTS, ITS and GL) 🇪🇺
  13. NIST AI Risk Management Framework 🇺🇸🤖
  14. NIST SP 800-53 rev5 🇺🇸
  15. Règles OIV - Secteur « Activités civiles de l'Etat » (2019) 🇫🇷
  16. CCB CyberFundamentals Framework 🇧🇪
  17. NIST SP-800-66 (HIPAA) 🏥
  18. HDS/HDH 🇫🇷
  19. OWASP Application Security Verification Standard (ASVS) 4 🐝🖥️
  20. RGS v2.0 🇫🇷
  21. AirCyber ✈️🌐
  22. Cyber Resilience Act (CRA) 🇪🇺
  23. TIBER-EU 🇪🇺
  24. NIST Privacy Framework 🇺🇸
  25. TISAX (VDA ISA) v5.1, v6.0 and v2027 🚘
  26. ANSSI hygiene guide 🇫🇷
  27. Essential Cybersecurity Controls (ECC) 🇸🇦
  28. CIS Controls v8* 🌐
  29. CSA CCM (Cloud Controls Matrix)* ☁️
  30. FADP (Federal Act on Data Protection) 🇨🇭
  31. NIST SP 800-171 rev2 (2021) 🇺🇸
  32. ANSSI : Recommandations de sécurité pour un système d'IA générative (v1.0) 🇫🇷🤖
  33. NIST SP 800-218: Secure Software Development Framework (SSDF) 🖥️
  34. GSA FedRAMP rev5 ☁️🇺🇸
  35. Cadre Conformité Cyber France (3CF) v1 (2021) ✈️🇫🇷
  36. ANSSI : SecNumCloud ☁️🇫🇷
  37. Cadre Conformité Cyber France (3CF) v2 (2024) ✈️🇫🇷
  38. ANSSI : outil d’autoévaluation de gestion de crise cyber 💥🇫🇷
  39. BSI: IT-Grundschutz-Kompendium 🇩🇪
  40. NIST SP 800-171 rev3 (2024) 🇺🇸
  41. ENISA: 5G Security Controls Matrix 🇪🇺
  42. OWASP Mobile Application Security Verification Standard (MASVS) 🐝📱
  43. Agile Security Framework (ASF) - baseline - by intuitem 🤗
  44. ISO 27001:2013 🌐 (For legacy and migration)
  45. EU AI Act 🇪🇺🤖
  46. FBI CJIS 🇺🇸👮
  47. Operational Technology Cybersecurity Controls (OTCC) 🇸🇦
  48. Secure Controls Framework (SCF) 🇺🇸🌐
  49. NCSC - Cyber Assessment Framework (CAF) v3.2 🇬🇧
  50. California Consumer Privacy Act (CCPA) 🇺🇸
  51. California Consumer Privacy Act Regulations 🇺🇸
  52. NCSC Cyber Essentials 🇬🇧
  53. Directive Nationale de la Sécurité des Systèmes d'Information (DNSSI) Maroc 🇲🇦
  54. Part-IS (Consolidated 16-10-2025) ✈️🇪🇺
  55. ENS Esquema Nacional de seguridad 🇪🇸
  56. Korea ISA ISMS-P 🇰🇷
  57. Swiss ICT minimum standard 🇨🇭
  58. Adobe Common Controls Framework (CCF) v5 🌐
  59. BSI Cloud Computing Compliance Criteria Catalogue (C5) 🇩🇪
  60. Référentiel d’Audit de la Sécurité des Systèmes d’Information, ANCS Tunisie 🇹🇳
  61. ECB Cyber resilience oversight expectations for financial market infrastructures 🇪🇺
  62. Mindeststandard-des-BSI-zur-Nutzung-externer-Cloud-Dienste (Version 2.1) 🇩🇪
  63. Formulaire d'évaluation de la maturité - niveau fondamental (DGA) 🇫🇷
  64. NIS2 technical and methodological requirements 2024/2690 🇪🇺
  65. Saudi Arabian Monetary Authority (SAMA) Cybersecurity Framework 🇸🇦
  66. Guide de sécurité des données (CNIL) 🇫🇷
  67. International Traffic in Arms Regulations (ITAR) 🇺🇸
  68. Federal Trade Commission (FTC) Standards for Safeguarding Customer Information 🇺🇸
  69. OWASP's checklist for LLM governance and security 🌐
  70. ANSSI : Recommandations pour les architectures des systèmes d’information sensibles ou à diffusion restreinte (v1.2) 🇫🇷
  71. CIS benchmark for Kubernetes v1.10 🌐
  72. De tekniske minimumskrav for statslige myndigheder 🇩🇰
  73. Google SAIF framework 🤖
  74. ANSSI : Recommandations relatives à l'administration sécurisée des SI (v3.0) 🇫🇷
  75. Prudential Standard CPS 230 - Operational Risk Management (APRA) 🇦🇺
  76. Prudential Standard CPS 234 - Information Security (APRA) 🇦🇺
  77. Vehicle Cyber Security Audit (VCSA) v1.1 🚘
  78. Cisco Cloud Controls Framework (CCF) v3.0 ☁️🌐
  79. FINMA - Circular 2023/01 - Operational risks and resilience - Banks 🇨🇭
  80. Post-Quantum Cryptography (PQC) Migration Roadmap (May 2025) 🔐
  81. Cloud Sovereignty Framework - 1.2.1 - Oct 2025 🇪🇺
  82. ISO 22301:2019 outline - Business continuity management systems 🌐
  83. CCB CyberFundamentals Framework 2025 🇧🇪
  84. Prestataires de détection des incidents de sécurité (PDIS) - Référentiel d’exigences 🇫🇷
  85. Vendor Due Diligence - simple baseline - intuitem 🌐
  86. ANSSI : Points de contrôle Active Directory (AD) (Avril 2026) 🇫🇷
  87. ISO 42001:2023 outline - Artificial Intelligence Management System, including Annex A 🤖🌐
  88. India's Digital Personal Data Protection Act (DPDPA) - 2023 🇮🇳
  89. E-ITS (Estonia's national cyber security standard) - 2024 🇪🇪
  90. Microsoft cloud security benchmark v1 - ☁️🌐
  91. Baseline informatiebeveiliging Overheid 2 (BIO2) 🇳🇱
  92. ANSSI : Questionnaire MonAideCyber 🇫🇷
  93. ITSP.10.171 - Protecting specified information in non-Government of Canada systems and organizations 🇨🇦
  94. CISA Vendor Supply Chain Risk Management (SCRM) Template 🇺🇸
  95. European Sustainability Reporting Standards (ESRS) 🇪🇺
  96. ITIL 4 Management Practices 🌐
  97. NOREA - DORA in Control Framework v3.0 🇪🇺
  98. NIS-1 transposition FR 🇫🇷
  99. PSSI État 🇫🇷
  100. Checklist de dossier d'homologation 🇫🇷
  101. Cahier des charges Label EBIOS RM v3.1 🇫🇷
  102. SecNumCloud v3.2 Annexe 2 : Recommandations aux commanditaires ☁️🇫🇷
  103. CCB CyberFundamentals Small - Self assessment 🇧🇪
  104. Mitre ATT&CK v19.1 - Threats and Mitigations catalog 🌐
  105. Mitre D3FEND - Reference controls 🌐
  106. OWASP Top 10 Web - Threat catalog 🐝🌐
  107. OWASP MAS Threat Modelling Guide - Threat catalog 🐝📱
  108. CISA Cybersecurity Performance Goals (CPG) v2.0 🇺🇸
  109. ANSSI : Référentiel Cyber France pour la réglementation NIS2 (ReCyF) 🇫🇷
  110. Cadre Conformité Cyber France (3CF) v3.1 (2026) ✈️🇫🇷
  111. Règles OIV - Secteur « Transport aérien » (2016) ✈️🇫🇷
  112. IEC 62443 series — parts 2-1, 2-4, 3-2, 3-3, 4-1, 4-2 🏭🌐
  113. CER Directive (Critical Entities Resilience) 🇪🇺
  114. EUDI ARF — EU Digital Identity Wallet High-Level Requirements (Annex 2.02) 🇪🇺
  115. UK Defence Standard 05-138 Issue 4 🇬🇧
  116. Référentiel HAS - Certification des établissements de santé pour la qualité des soins 🇫🇷🏥
  117. Personal Data Protection Law (PDPL) 🇸🇦
  118. NCSC - Cyber Assessment Framework (CAF) v4.0 🇬🇧
  119. Algemene Beveiligingseisen voor Rijksoverheidsopdrachten (ABRO) 2026 🇳🇱
  120. Algemene Beveiligingseisen voor Defensieopdrachten (ABDO) 2019 🇳🇱

Community contributions

  1. PGSSI-S (Politique Générale de Sécurité des Systèmes d'Information de Santé) 🇫🇷
  2. ANSSI : Recommandations de configuration d'un système GNU/Linux (v2.0) 🇫🇷
  3. PSSI-MCAS (Politique de sécurité des systèmes d’information pour les ministères chargés des affaires sociales) 🇫🇷
  4. ANSSI : Recommandations pour la protection des systèmes d'information essentiels (v1.0) 🇫🇷
  5. ANSSI : Recommandations de sécurité pour l'architecture d'un système de journalisation (v2.0) 🇫🇷
  6. ANSSI : Recommandations de sécurité relatives à TLS (v1.2) 🇫🇷
  7. New Zealand Information Security Manual (NZISM) 🇳🇿
  8. Clausier de sécurité numérique du Club RSSI Santé 🇫🇷
  9. Référentiel National de Sécurité de l’Information (RNSI), MPT Algérie 🇩🇿
  10. Misure minime di sicurezza ICT per le pubbliche amministrazioni, AGID Italia 🇮🇹
  11. Framework Nazionale CyberSecurity v2, FNCS Italia 🇮🇹
  12. Framework Nazionale per la Cybersecurity e la Data Protection, ACN Italia 🇮🇹
  13. PSSIE du Bénin, ANSSI Bénin 🇧🇯
  14. IGI 1300 / II 901 - Liste des exigences pour la mise en oeuvre d'un SI classifié (ANSSI) 🇫🇷
  15. Référentiel Général de Sécurité 2.0 - Annexe B2 🇫🇷
  16. ANSSI : Recommandations sur la sécurisation des systèmes de contrôle d'accès physique et de vidéoprotection (v2.2) 🇫🇷
  17. ANSSI : Recommandations pour un usage sécurisé d’(Open)SSH (v1.3) 🇫🇷
  18. ANSSI : Recommandations de sécurité relatives à IPsec pour la protection des flux réseau (v1.1) 🇫🇷
  19. ANSSI : Recommandations relatives à l'interconnexion d'un système d'information à internet (v3.0) 🇫🇷
  20. Guides des mécanismes cryptographiques 🇫🇷
  21. Swift Customer Security Controls Framework (CSCF) v2025 🏦🌐
  22. OWASP Application Security Verification Standard (ASVS) 5 🐝🖥️
  23. NIST 800-82 (OT) - appendix 🏭🤖
  24. RBI Master Direction 2023 - india 🏦🇮🇳
  25. Loi 05-20 relative à la cybersécurité (Maroc) 🇲🇦
  26. Lithuanian NIS2 Cybersecurity Law (Kibernetinio saugumo įstatymas) 🇱🇹
  27. Prestataire d'audit de sécurité des systèmes d'information (PASSI) 🇫🇷
  28. ANS Programme CaRE - Domaine 2 (Continuité et reprise d'activité, sauvegarde) 🇫🇷🏥
  29. ANS HospiConnect HOP'EN2 (Sécurisation de l'accès au SIH) 🇫🇷🏥
  30. Loi n° 09-08 relative à la protection des personnes physiques 🇲🇦
  31. Checklist des exigences de la Loi n° 09-08 🇲🇦
  32. Référentiel des exigences de qualification des prestataires de services cloud ☁️🇲🇦
  33. AI Defense Matrix 🤖🌐
  34. Zero Trust for Operational Technology (ZT OT) 🇺🇸🏭
  35. T.C. CBDDO Bilgi ve İletişim Güvenliği Rehberi (BİGR) 🇹🇷
  36. NCA NCNICC-1:2025 🇸🇦
  37. NCA ECC-2:2024 🇸🇦
  38. NCA CCC-1:2020 🇸🇦

[!NOTE]
Frameworks with * require an extra manual step of getting the latest Excel sheet through their website as their license prevent direct usage. You can load the Excel sheet directly as a library.

Checkout the library and tools for the Domain Specific Language used and how you can define your own.

Coming soon

  • Indonesia PDP 🇮🇩

  • OWASP SAMM

  • COBAC R-2024/01

  • ICO Data protection self-assessment 🇬🇧

  • ASD ISM 🇦🇺

  • and much more: just ask on Discord. If it's an open standard, we'll do it for you, free of charge 😉

Add your own custom library

A library can represent a framework, a threat catalog, a set of reference controls, or even a custom risk matrix.

Libraries can now be loaded directly from Excel files. There is no need to manually convert them to YAML beforehand—the conversion is handled internally when an Excel file is uploaded.

Take a look at the tools directory and its dedicated README, which describes the expected format of library source files in Excel. The excel subdirectory contains example XLSX files used as sources for the existing libraries and can be used as templates for creating your own.

To load a library from an Excel file, go to the Governance → Library page, click Load, and select your Excel source file. Any validation or parsing errors will be reported during the import process.

Optional: converting libraries to YAML

While Excel files can be loaded directly, it is still possible to convert library source files to YAML using external Python scripts:

  • convert_library_v2.py helps you generate a library from a simple Excel file. Once your items are structured in the expected format, run the script to produce the corresponding YAML file.
  • The tools directory also contains specialized converters for specific frameworks (for example, CIS or CCM Controls).

Creating mapping libraries

To facilitate the creation of mappings between frameworks, you can use the prepare_mapping_v2.py tool. It generates an Excel file based on two existing framework libraries in YAML format. After filling in the mappings, the resulting Excel file can be:

  • loaded directly into the application, or
  • converted to YAML using convert_library_v2.py.

Community

Join our open Discord community to interact with the team and other GRC experts.

Testing the cloud version

The fastest and easiest way to get started is through the free trial of cloud instance available here.

Testing locally 🚀

To run CISO Assistant locally in a straightforward way, you can use Docker compose.

  1. Update docker

Make sure you have a recent version of docker (>= 27.0).

  1. Clone the repository
sh
git clone --single-branch -b main https://github.com/intuitem/ciso-assistant-community.git
cd ciso-assistant-community
  1. Launch docker-compose script for prebuilt images:
sh
./docker-compose.sh     # Linux/MacOS
./docker-compose.ps1    # Windows

Alternatively, you can use this variant to build the docker images for your specific architecture:

sh
./docker-compose-build.sh     # Linux/MacOS
./docker-compose-build.ps1    # Windows

When asked for, enter your email and password for your superuser.

You can then reach CISO Assistant using your web browser at https://localhost:8443/

For the following executions, use "docker compose up" directly.

Setting up CISO Assistant for development

[!WARNING]

Important note for Windows users

The best working solution for users developing on Windows is to use Ubuntu installed on WSL2 (Docker is not required).

It is now also possible to run and develop CISO Assistant natively on Windows without WSL2 nor Docker, but it will require some extra steps.
Please note that the native running on Windows is still in EXPERIMENTAL PHASE and should NOT be used if you are unsure of what you are doing, or if you want to ensure stability throughout development.
Nevertheless, we would love to hear any suggestions in order to enhance the development experience for Windows users. Please feel free to open an Issue/PR about it!

Requirements

  • Python 3.14+
  • pip 25.3+
  • uv 0.9+
  • node 24+
  • npm 10.2+
  • pnpm 10.30+
  • yaml-cpp (brew install yaml-cpp libyaml or apt install libyaml-cpp-dev)

[EXPERIMENTAL] Additional requirements for development on Windows without WSL2

If you want to develop the project without WSL2, you will need to install MSYS2, add the MSYS2 UCRT64 binaries to your system PATH environment variable (usually, the binaries are in C:\msys64\ucrt64\bin) and then install the following dependencies via pacman using MSYS2 UCRT64.

sh
pacman -S mingw-w64-ucrt-x86_64-file mingw-w64-ucrt-x86_64-pango

You will also have to add those 2 system environment variables after installing the dependencies:

conf
MAGIC=Full path to the `magic.mgc` file (usually `C:\msys64\ucrt64\share\misc\magic.mgc`)
WEASYPRINT_DLL_DIRECTORIES=Same path as your MSYS2 UCRT64 binaries

Given that the default encoding on Windows isn't UTF-8 but cp1252, certain python script printing UTF-8 characters such as emojis may cause the backend crash or malfunction in some cases (e.g. library importation).
To avoid this issue with this project, enforce the UTF-8 encoding by adding these 2 user environment variables:

conf
PYTHONUTF8=1
PYTHONIOENCODING=utf-8:replace

[!NOTE]

Known issues

  • The libmagic library on Windows (MIME detection) struggles to recognize an Excel file (.xlsx) by reading its first 2048 bits as it returns application/octet-stream most of the time when importing an Excel library (backend displays the warning message [warning ] Invalid MIME type). This doesn't prevent the Excel file from being imported thanks to the fallback method in backend/library/views.py:StoredLibraryViewSet.upload_library.

Running the backend

  1. Clone the repository.
sh
git clone [email protected]:intuitem/ciso-assistant-community.git
cd ciso-assistant-community
  1. Create a file in the parent folder (e.g. ../myvars) and store your environment variables within it by copying and modifying the following code and replace "<XXX>" by your private values. Take care not to commit this file in your git repo.

Mandatory variables

All variables in the backend have handy default values.

Recommended variables

sh
export DJANGO_DEBUG=True

# Default url is set to http://localhost:5173 but you can change it, e.g. to use https with a caddy proxy
export CISO_ASSISTANT_URL=https://localhost:8443

# Setup a development mailer with Mailhog for example
export EMAIL_HOST_USER=''
export EMAIL_HOST_PASSWORD=''
export [email protected]
export EMAIL_HOST=localhost
export EMAIL_PORT=1025
export EMAIL_USE_TLS=True  # true for STARTTLS
export EMAIL_USE_SSL=False # true for SMTPS

Other variables

text
/* Detailed source-code truncated for AI context efficiency. */

[EXPERIMENTAL] Other variable for development on Windows without WSL2

Only PostgreSQL custom variables can be configured.

Use the helper scripts documented in tools/.windows/README.md for more information.

  1. Install uv

Visit the uv website for instructions: https://docs.astral.sh/uv/getting-started/installation/

  1. Move to backend and install required dependencies.
sh
cd backend
uv sync
  1. Recommended: Install the pre-commit hooks.
sh
pre-commit install
  1. If you want to setup Postgres:
  • Launch one of these commands to enter in Postgres:
    • psql as superadmin
    • sudo su postgres
    • psql
  • Create the database "ciso-assistant"
    • create database ciso-assistant;
  • Create user "ciso-assistantuser" and grant it access
    • create user ciso-assistantuser with password '';
    • grant all privileges on database ciso-assistant to ciso-assistantuser;

[EXPERIMENTAL] Setup PostgreSQL on Windows

For more information, see the documentation in tools/.windows/README.md.

  1. If you want to setup s3 bucket:
  • Choose your s3 provider or try s3 feature with miniO with this command:
    • docker run -p 9000:9000 -p 9001:9001 -e "MINIO_ROOT_USER=XXX" -e "MINIO_ROOT_PASSWORD=XXX" quay.io/minio/minio server /data --console-address ":9001"
  • You can now check your bucket on http://localhost:9001
    • Fill the login with the credentials you filled on the docker run env variables
  • Export in the backend directory all the env variables asked about S3
    • You can see the list above in the recommanded variables
  1. Apply migrations.
sh
uv run python manage.py migrate

[EXPERIMENTAL] Apply migration on Windows without WSL2

For more information, see the documentation in tools/.windows/README.md.

  1. Create a Django superuser, that will be CISO Assistant administrator.

If you have set a mailer and CISO_SUPERUSER_EMAIL variable, there's no need to create a Django superuser with createsuperuser, as it will be created automatically on first start. You should receive an email with a link to setup your password.

sh
uv run python manage.py createsuperuser

[EXPERIMENTAL] Create a Django superuser on Windows without WSL2

For more information, see the documentation in tools/.windows/README.md.

  1. Run development server.
sh
uv run python manage.py runserver

[EXPERIMENTAL] How to run development server natively on Windows?

When running Django's development server natively on Windows, SvelteKit SSR can open enough concurrent API connections to hit the server's small default listen backlog. This may cause intermittent ECONNREFUSED / TypeError: fetch failed errors in the frontend.

Use the helper scripts documented in tools/.windows/README.md for the native Windows development setup.

  1. For Huey (tasks runner)
  • prepare a mailer for testing.
  • run python manage.py run_huey -w 2 -k process or equivalent in a separate shell.
  • you can use MAIL_DEBUG to have mail on the console for easier debug

Running the frontend

  1. cd into the frontend directory
shell
cd frontend
  1. Install dependencies
bash
npm install pnpm
pnpm install
  1. Start a development server (make sure that the django app is running)
bash
pnpm run dev
  1. Reach the frontend on http://localhost:5173

[!NOTE]
Safari will not properly work in this setup, as it requires https for secure cookies. The simplest solution is to use Chrome or Firefox. An alternative is to use a caddy proxy. Please see the readme file in frontend directory for more information on this.

  1. Environment variables

All variables in the frontend have handy default values.

If you move the frontend on another host, you should set the following variable: PUBLIC_BACKEND_API_URL. Its default value is http://localhost:8000/api.

The PUBLIC_BACKEND_API_EXPOSED_URL is necessary for proper functioning of the SSO. It points to the URL of the API as seen from the browser. It should be equal to the concatenation of CISO_ASSISTANT_URL (in the backend) with "/api".

When you launch "node server" instead of "pnpm run dev", you need to set the ORIGIN variable to the same value as CISO_ASSISTANT_URL in the backend (e.g. http://localhost:3000).

Managing migrations

The migrations are tracked by version control, https://docs.djangoproject.com/en/4.2/topics/migrations/#version-control

For the first version of the product, it is recommended to start from a clean migration.

Note: to clean existing migrations, type:

sh
find . -path "*/migrations/*.py" -not -name "__init__.py" -delete
find . -path "*/migrations/*.pyc"  -delete

After a change (or a clean), it is necessary to re-generate migration files:

sh
uv run python manage.py makemigrations
uv run python manage.py migrate

These migration files should be tracked by version control.

Test suite

To run API tests on the backend, simply type uv run pytest in a shell in the backend folder.

To run functional tests on the frontend, do the following actions:

  • in the frontend folder, launch the following command:
shell
tests/e2e-tests.sh

The goal of the test harness is to prevent any regression, i.e. all the tests shall be successful, both for backend and frontend.

API and Swagger

  • The interactive API documentation (Swagger UI) is available only in development mode.
    To enable it, set export DJANGO_DEBUG=True before starting the backend.
  • Once the server is running, the documentation will be accessible at /api/schema/swagger/,
    for example: http://127.0.0.1:8000/api/schema/swagger/.

To interact with the API via Swagger or directly with HTTP calls:

  1. Create a Personal Access Token (PAT) from your user profile in the application.
  2. Include this token in the header of subsequent requests as: Authorization: Token <token>

⚠️ Note: use Token, not Bearer.

PATs respect MFA: they are issued from an authenticated session, so an account protected by MFA stays protected. For interactive/browser flows, authentication goes through the standard login (which enforces MFA when enabled).

Setting CISO Assistant for production

The docker-compose.yml highlights a relevant configuration for testing, with a Caddy proxy in front of the frontend. It exposes the full API, which is not yet recommended for production.

For production, the config builder can be used to generate a more hardened and tailored docker-compose.yml file, though several hardening steps are still required.

The following recommendations apply for production:

  • Set DJANGO_DEBUG=False for security reasons.
  • Pin versions to the latest production version for all images (backend, frontend, reverse proxy)
  • Harden the network configuration to expose only the relevant ports, and filter the URLs to limit full API access to trusted IP ranges.
    If public API access is restricted and SSO is enabled, keep these endpoints reachable by the browser or identity provider:
    • /api/iam/sso/redirect/
    • /api/accounts/saml/0/acs/
    • /api/accounts/saml/0/acs/finish/
    • /api/accounts/oidc/openid_connect/login/callback/
    • /api/iam/sso/logout/
  • Use non-root deployment, as explained below.
  • Use a valid certificate for the reverse proxy
  • If the reverse proxy is not running on the same host as the backend and frontend, use a VPN like wireguard between the nodes.
  • Use an encrypted volume for the database, and manage the encryption key cautiously.
  • Manage secrets in environment variables instead of putting them directly in the docker-compose.yml file.

[!NOTE]
The frontend cannot infer the host automatically, so you need to either set the ORIGIN variable, or the HOST_HEADER and PROTOCOL_HEADER variables. Please see the sveltekit doc on this tricky issue. Beware that this approach does not work with "pnpm run dev", which should not be a worry for production.

[!NOTE]
Caddy needs to receive a SNI header. Therefore, for your public URL (the one declared in CISO_ASSISTANT_URL), you need to use a FQDN, not an IP address, as the SNI is not transmitted by a browser if the host is an IP address. Another tricky issue!

[!NOTE]
The docker-compose template files are now launching the backend, huey and frontend in non-root mode. If you use an old docker-compose.yml file, it is recommended to update it. The containers are compatible with both root and non-root modes.

Non-root docker containers

docker-compose.yml now relies on a non-root user 1001:1001, which is available in the image. Older deployments are using root user, which is still supported. To transition to non-root, use the following steps in the host:

  • docker compose down
  • update the docker-compose.yml file
  • sudo chown -R 1001:1001 db
  • docker compose up -d

Supported languages 🌐

Reference is en.json; coverage = share of reference keys present in each locale file. Auto-refreshed daily — full breakdown at the dashboard.

Contributors 🤝

Built With 💜

  • Django - Python Web Development Framework
  • SvelteKit - Frontend Framework
  • eCharts - Charting library
  • unovis - Complementary charting library
  • Gunicorn - Python WSGI HTTP Server for UNIX
  • Caddy - The coolest reverse Proxy
  • Gitbook - Documentation platform
  • PostgreSQL - Open Source RDBMS
  • SQLite - Open Source RDBMS
  • Docker - Container Engine
  • inlang - The ecosystem to globalize your software
  • Huey - A lightweight task queue

Security

Great care has been taken to follow security best practices. Please report any issue to [email protected].

License

This repository contains the source code for both the Open Source edition of CISO Assistant (Community Edition), released under the AGPL v3, as well as the commercial edition of CISO Assistant (Pro and Enterprise Editions), released under the intuitem Commercial Software License. This mono-repository approach is adopted for simplicity.

All the files within the top-level "enterprise" directory are released under the intuitem Commercial Software License.

All the files outside the top-level "enterprise" directory are released under the AGPLv3.

See LICENSE.md for details. For more details about the commercial editions, you can reach us on [email protected].

Unless otherwise noted, all files are © intuitem.

Activity

Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#audit Browse audit catalog → #automation Browse automation catalog → #bsi Browse bsi catalog → #cis Browse cis catalog → #compliance Browse compliance catalog → ⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →