CISO Assistant User Guide

This guide provides an end-to-end operational manual for CISO Assistant, synthesized from the platform's core architecture and documentation. It focuses on the "how-to" for daily users, bypassing deep technical setup.

1. At a Glance: Core Navigation

The platform is organized into five primary domains in the sidebar. The "Golden Rule" of CISO Assistant is Decoupling: you define assets, risks, and controls once, and the engine maps them across various frameworks automatically.1

Domain

Primary Purpose

Perimeters

Define organizational boundaries (e.g., "Production," "Corporate").1

Assets

Inventory everything owned or operated, including dependency mapping.1

Frameworks

Access over 150+ pre-built standards (ISO 27001, NIST CSF, etc.).12

Audits

Active gap analyses and compliance assessment execution.1

Risk Assessments

Model threat scenarios and calculate financial or operational impact.1

2. Setting Up Your Organization

To begin using CISO Assistant effectively, follow this structural workflow:

Step 1: Create Perimeters & Folders

Perimeters prevent "messy overlap" between business units.

• Action: Create a Perimeter for each evaluate scope (e.g., Subsidiary A, Department B).1

• Grouping: Use Folders to organize these perimeters into a clear hierarchy.3

Step 2: Build the Asset Inventory

• Cataloging: Add software, data sets, and physical hardware.1

• Dependency Mapping: Link a business service (e.g., Patient Portal) to its underlying infrastructure (e.g., AWS). If a component fails, the system visualizes the high-level business impact.1

3. Compliance & Audit Workflows

CISO Assistant enables "Continuous Compliance" rather than one-off spreadsheet exercises.

Running an Audit

1. Select Framework: Choose from the library of 150+ templates or upload a custom Excel-based framework.12

2. Launch Campaign: Start an audit against a specific Perimeter.1

3. Cross-Mapping: The engine automatically applies controls used in other audits (e.g., an ISO 27001 access control will map to SOC 2).1

Delegation via Assignments

Managers can delegate audit tasks to specific team members:

• Draft: Set up the requirements and assign actors.3

• In Progress: Respondents are notified via email to begin work.3

• Review: Once submitted, reviewers can Close the task or Request Changes with specific feedback.3

4. Risk Management & Quantification

The platform shifts risk from subjective "Red/Yellow/Green" charts to actionable data.1

• Qualitative (Matrix): Use standard 3x3, 4x4, or 5x5 matrices for quick assessments.3

• Quantitative (CRQ): Attach financial loss or recovery metrics to threat scenarios to see actual residual risk after controls are applied.1

• Threat Catalog: Leverage the built-in library (e.g., ICT-001 Ransomware, ICT-002 Phishing) to model scenarios quickly.3

5. Applied Controls & Evidence

This is the "master list" of your active security measures.

• Continuous Lifecycle: Instead of static "Yes/No" answers, assign owners and set recurring review schedules (e.g., every 90 days).1

• Evidence Collection: System owners upload text, links, or files directly into the control. These update in real-time across every audit using that control.1

6. Quality Assurance (X-rays)

The X-rays feature automatically scans your assessments for inconsistencies.2

• Errors: Critical issues (e.g., a risk scenario with no assets linked).2

• Warnings: Important items (e.g., an assessment with no assigned author).2

• Info: General status updates (e.g., "Assessment still in progress").2