CISO Assistant Features

Upcoming features are listed on the roadmap. 

Core Concepts

Here’s an extract of some of the building blocks in CISO Assistant to illustrate the decoupling concept that encourages reusability:

For full details, check the data model documentation. 

Decoupling Concept

At the heart of CISO Assistant lies the decoupling principle, which enables powerful use cases and major time savings:

• Reuse past assessments across scopes or frameworks,

• Evaluate a single scope against multiple frameworks simultaneously,

• Let CISO Assistant handle reporting and consistency checks so you can focus on remediation,

• Separate control implementation from compliance tracking.

System architecture

Supported frameworks 

1. ISO 27001:2013 & 27001:2022 

2. NIST Cyber Security Framework (CSF) v1.1 🇺🇸

3. NIST Cyber Security Framework (CSF) v2.0 🇺🇸

4. NIS2 🇪🇺

5. SOC2 🇺🇸

6. PCI DSS 4.0.1 

7. CMMC v2 🇺🇸

8. PSPF 🇦🇺

9. General Data Protection Regulation (GDPR): Full text and checklist from GDPR.EU 🇪🇺

10. Essential Eight 🇦🇺

11. NYDFS 500 with 2023-11 amendments 🇺🇸

12. DORA (Act, RTS, ITS and GL) 🇪🇺

13. NIST AI Risk Management Framework 🇺🇸

14. NIST SP 800-53 rev5 🇺🇸

15. Règles OIV - Secteur « Activités civiles de l'Etat » (2019) 🇫🇷

16. CCB CyberFundamentals Framework 🇧🇪

17. NIST SP-800-66 (HIPAA) 

18. HDS/HDH 🇫🇷

19. OWASP Application Security Verification Standard (ASVS) 4 

20. RGS v2.0 🇫🇷

21. AirCyber 

22. Cyber Resilience Act (CRA) 🇪🇺

23. TIBER-EU 🇪🇺

24. NIST Privacy Framework 🇺🇸

25. TISAX (VDA ISA) v5.1 and v6.0 

26. ANSSI hygiene guide 🇫🇷

27. Essential Cybersecurity Controls (ECC) 🇸🇦

28. CIS Controls v8* 

29. CSA CCM (Cloud Controls Matrix)* 

30. FADP (Federal Act on Data Protection) 🇨🇭

31. NIST SP 800-171 rev2 (2021) 🇺🇸

32. ANSSI : recommandations de sécurité pour un système d'IA générative 🇫🇷

33. NIST SP 800-218: Secure Software Development Framework (SSDF) 

34. GSA FedRAMP rev5 🇺🇸

35. Cadre Conformité Cyber France (3CF) v1 (2021) 🇫🇷

36. ANSSI : SecNumCloud 🇫🇷

37. Cadre Conformité Cyber France (3CF) v2 (2024) 🇫🇷

38. ANSSI : outil d’autoévaluation de gestion de crise cyber 🇫🇷

39. BSI: IT-Grundschutz-Kompendium 🇩🇪

40. NIST SP 800-171 rev3 (2024) 🇺🇸

41. ENISA: 5G Security Controls Matrix 🇪🇺

42. OWASP Mobile Application Security Verification Standard (MASVS) 

43. Agile Security Framework (ASF) - baseline - by intuitem 

44. ISO 27001:2013  (For legacy and migration)

45. EU AI Act 🇪🇺

46. FBI CJIS 🇺🇸

47. Operational Technology Cybersecurity Controls (OTCC) 🇸🇦

48. Secure Controls Framework (SCF) 🇺🇸

49. NCSC - Cyber Assessment Framework (CAF) v3.2 🇬🇧

50. California Consumer Privacy Act (CCPA) 🇺🇸

51. California Consumer Privacy Act Regulations 🇺🇸

52. NCSC Cyber Essentials 🇬🇧

53. Directive Nationale de la Sécurité des Systèmes d'Information (DNSSI) Maroc 🇲🇦

54. Part-IS 🇪🇺

55. ENS Esquema Nacional de seguridad 🇪🇸

56. Korea ISA ISMS-P 🇰🇷

57. Swiss ICT minimum standard 🇨🇭

58. Adobe Common Controls Framework (CCF) v5 

59. BSI Cloud Computing Compliance Criteria Catalogue (C5) 🇩🇪

60. Référentiel d’Audit de la Sécurité des Systèmes d’Information, ANCS Tunisie 🇹🇳

61. ECB Cyber resilience oversight expectations for financial market infrastructures 🇪🇺

62. Mindeststandard-des-BSI-zur-Nutzung-externer-Cloud-Dienste (Version 2.1) 🇩🇪

63. Formulaire d'évaluation de la maturité - niveau fondamental (DGA) 🇫🇷

64. NIS2 technical and methodological requirements 2024/2690 🇪🇺

65. Saudi Arabian Monetary Authority (SAMA) Cybersecurity Framework 🇸🇦

66. Guide de sécurité des données (CNIL) 🇫🇷

67. International Traffic in Arms Regulations (ITAR) 🇺🇸

68. Federal Trade Commission (FTC) Standards for Safeguarding Customer Information 🇺🇸

69. OWASP's checklist for LLM governance and security 

70. Recommandations pour les architectures des systèmes d’information sensibles ou à diffusion restreinte (ANSSI) 🇫🇷

71. CIS benchmark for Kubernetes v1.10 

72. De tekniske minimumskrav for statslige myndigheder 🇩🇰

73. Google SAIF framework 

74. Recommandations relatives à l'administration sécurisée des SI (ANSSI) 🇫🇷

75. Prudential Standard CPS 230 - Operational Risk Management (APRA) 🇦🇺

76. Prudential Standard CPS 234 - Information Security (APRA) 🇦🇺

77. Vehicle Cyber Security Audit (VCSA) v1.1 

78. Cisco Cloud Controls Framework (CCF) v3.0 

79. FINMA - Circular 2023/01 - Operational risks and resilience - Banks 🇨🇭

80. Post-Quantum Cryptography (PQC) Migration Roadmap (May 2025) 

81. Cloud Sovereignty Framework - 1.2.1 - Oct 2025 🇪🇺

82. ISO 22301:2019 outline - Business continuity management systems 

83. CCB CyberFundamentals Framework 2025 🇧🇪

84. Prestataires de détection des incidents de sécurité (PDIS) - Référentiel d’exigences 🇫🇷

85. Vendor Due Diligence - simple baseline - intuitem 

86. Points de contrôle Active Directory (AD) - ANSSI 🇫🇷

87. ISO 42001:2023 outline - Artificial Intelligence Management System, including Annex A 

88. India's Digital Personal Data Protection Act (DPDPA) - 2023 🇮🇳

89. E-ITS (Estonia's national cyber security standard) - 2024 🇪🇪

90. Microsoft cloud security benchmark v1 - 

91. Baseline informatiebeveiliging Overheid 2 (BIO2) 🇳🇱

92. ANSSI : Questionnaire MonAideCyber 🇫🇷

93. ITSP.10.171 - Protecting specified information in non-Government of Canada systems and organizations 🇨🇦

94. CISA Vendor Supply Chain Risk Management (SCRM) Template 🇺🇸

95. European Sustainability Reporting Standards (ESRS) 🇪🇺

96. ITIL 4 Management Practices 

97. NOREA - DORA in Control Framework v3.0 🇪🇺

98. NIS-1 transposition FR 🇫🇷

99. PSSI État 🇫🇷

100. Checklist de dossier d'homologation 🇫🇷

101. Cahier des charges Label EBIOS RM v3.1 🇫🇷

102. SecNumCloud v3.2 Annexe 2 : recommandations aux commanditaires 🇫🇷

103. CCB CyberFundamentals Small - Self assessment 🇧🇪

104. Mitre ATT&CK v18.1 - Threat catalog 

105. Mitre D3FEND - Reference controls 

106. OWASP Top 10 Web - Threat catalog 

107. OWASP MAS Threat Modelling Guide - Threat catalog 

108. CISA Cybersecurity Performance Goals (CPG) v2.0 🇺🇸

109. ANSSI : Référentiel Cyber France pour la réglementation NIS2 (ReCyF) 🇫🇷

110. Cadre Conformité Cyber France (3CF) v3.1 (2026) 🇫🇷

111. Règles OIV - Secteur « Transport aérien » (2016) 🇫🇷

112. IEC 62443 series — parts 2-1, 2-4, 3-2, 3-3, 4-1, 4-2 

113. CER Directive (Critical Entities Resilience) 🇪🇺

114. EUDI ARF — EU Digital Identity Wallet High-Level Requirements (Annex 2.02) 🇪🇺

115. UK Defence Standard 05-138 Issue 4 🇬🇧

116. Référentiel HAS - Certification des établissements de santé pour la qualité des soins 🇫🇷

117. Personal Data Protection Law (PDPL) 🇸🇦

118. NCSC - Cyber Assessment Framework (CAF) v4.0 🇬🇧

119. Algemene Beveiligingseisen voor Rijksoverheidsopdrachten (ABRO) 2026 🇳🇱

Community contributions

1. PGSSI-S (Politique Générale de Sécurité des Systèmes d'Information de Santé) 🇫🇷

2. ANSSI : Recommandations de configuration d'un système GNU/Linux 🇫🇷

3. PSSI-MCAS (Politique de sécurité des systèmes d’information pour les ministères chargés des affaires sociales) 🇫🇷

4. ANSSI : Recommandations pour la protection des systèmes d'information essentiels 🇫🇷

5. ANSSI : Recommandations de sécurité pour l'architecture d'un système de journalisation 🇫🇷

6. ANSSI : Recommandations de sécurité relatives à TLS 🇫🇷

7. New Zealand Information Security Manual (NZISM) 🇳🇿

8. Clausier de sécurité numérique du Club RSSI Santé 🇫🇷

9. Référentiel National de Sécurité de l’Information (RNSI), MPT Algérie 🇩🇿

10. Misure minime di sicurezza ICT per le pubbliche amministrazioni, AGID Italia 🇮🇹

11. Framework Nazionale CyberSecurity v2, FNCS Italia 🇮🇹

12. Framework Nazionale per la Cybersecurity e la Data Protection, ACN Italia 🇮🇹

13. PSSIE du Bénin, ANSSI Bénin 🇧🇯

14. IGI 1300 / II 901 - Liste des exigences pour la mise en oeuvre d'un SI classifié (ANSSI) 🇫🇷

15. Référentiel Général de Sécurité 2.0 - Annexe B2 🇫🇷

16. Recommandations sur la sécurisation des systèmes de contrôle d'accès physique et de vidéoprotection 🇫🇷

17. Recommandations pour un usage sécurisé d’(Open)SSH 🇫🇷

18. Recommandations de sécurité relatives à IPsec pour la protection des flux réseau 🇫🇷

19. Recommandations relatives à l'interconnexion d'un système d'information à internet 🇫🇷

20. Guides des mécanismes cryptographiques 🇫🇷

21. Swift Customer Security Controls Framework (CSCF) v2025 

22. OWASP Application Security Verification Standard (ASVS) 5 

23. NIST 800-82 (OT) - appendix 

24. RBI Master Direction 2023 - india 🇮🇳

25. Loi 05-20 relative à la cybersécurité (Maroc) 🇲🇦

26. Lithuanian NIS2 Cybersecurity Law (Kibernetinio saugumo įstatymas) 🇱🇹

27. Prestataire d'audit de sécurité des systèmes d'information (PASSI) 🇫🇷

28. ANS Programme CaRE - Domaine 2 (Continuité et reprise d'activité, sauvegarde) 🇫🇷

29. ANS HospiConnect HOP'EN2 (Sécurisation de l'accès au SIH) 🇫🇷

30. Loi n° 09-08 relative à la protection des personnes physiques 🇲🇦

31. Checklist des exigences de la Loi n° 09-08 🇲🇦

32. Référentiel des exigences de qualification des prestataires de services cloud ☁️🇲🇦

33. AI Defense Matrix 

34. Zero Trust for Operational Technology (ZT OT) 🇺🇸

35. T.C. CBDDO Bilgi ve İletişim Güvenliği Rehberi (BİGR) 🇹🇷

Note

Frameworks with * require an extra manual step of getting the latest Excel sheet through their website as their license prevent direct usage. You can load the Excel sheet directly as a library.

Add your own custom library

A library can represent a framework, a threat catalog, a set of reference controls, or even a custom risk matrix.

Libraries can now be loaded directly from Excel files. There is no need to manually convert them to YAML beforehand—the conversion is handled internally when an Excel file is uploaded.

Take a look at the tools directory and its dedicated README, which describes the expected format of library source files in Excel. The excel subdirectory contains example XLSX files used as sources for the existing libraries and can be used as templates for creating your own.

To load a library from an Excel file, go to the Governance → Library page, click Load, and select your Excel source file. Any validation or parsing errors will be reported during the import process.

Optional: converting libraries to YAML

While Excel files can be loaded directly, it is still possible to convert library source files to YAML using external Python scripts:

• convert_library_v2.py helps you generate a library from a simple Excel file. Once your items are structured in the expected format, run the script to produce the corresponding YAML file.

• The tools directory also contains specialized converters for specific frameworks (for example, CIS or CCM Controls).

Creating mapping libraries

To facilitate the creation of mappings between frameworks, you can use the prepare_mapping_v2.py tool. It generates an Excel file based on two existing framework libraries in YAML format. After filling in the mappings, the resulting Excel file can be:

• loaded directly into the application, or

• converted to YAML using convert_library_v2.py.