CISO Assistant Journeys

In CISO Assistant, the concept of Journeys refers to the core end-to-end user workflows that guide you from an initial empty instance to a mature, automated, and audit-ready Governance, Risk, and Compliance (GRC) posture.1

Rather than treating cybersecurity tasks as isolated spreadsheet exercises, CISO Assistant structures its operations into defined lifecycles. Depending on your organization's primary goals, you will follow one of three primary functional journeys:1

1. The Core Three-Step Journey (The Baseline)

For most organizations, the standard platform journey is a sequential progression that ensures your technical environment is directly connected to business risk and compliance metrics:

┌────────────────────────┐      Links To        ┌────────────────────────┐

│  1. Setup Perimeters   │─────────────────────►│ 2. Risk Assessments    │

│  & Asset Inventories   │                      │ (Threat-Asset Modeling)│

└────────────────────────┘                      └───────────┬────────────┘

                                                            │

                                                            ▼

┌────────────────────────┐   Reuses Controls &  ┌────────────────────────┐

│  Continuous Improvement│◄─────────────────────│  3. Compliance Audits  │

│    (X-Rays & Metrics)  │       Evidence       │  (ISO, NIST, SOC2, etc)│

└────────────────────────┘                      └────────────────────────┘

• Step 1: Scoping (Perimeters & Assets): You begin by defining organizational boundaries (Perimeters) and grouping them into Folders or Domains to segment access controls. You then populate your inventory with Primary Assets (business data/critical processes) and link them to their dependent Supporting Assets (cloud infrastructure, databases).1

• Step 2: Risk Assessments: You model potential threat scenarios using standard configurations (e.g., [Threat] on [Asset]) to calculate inherent risk scores based on asset business criticality.1

• Step 3: Compliance Assessments: You launch active gap analyses or audits against pre-built standards (like ISO 27001, SOC 2, or NIST CSF). Thanks to the platform's decoupling principle, security controls and uploaded evidence are shared across both the risk registers and the compliance audits simultaneously, preventing redundant data entry.1

2. The Collaborative Assignment Workflow (The Human Journey)

When running large compliance audits, the platform utilizes a distinct Assignment Submission and Review Workflow to delegate work to distributed system owners without locking the entire audit container:1

• Draft: The GRC Manager sets up requirements and structures tasks. Respondents (auditees) cannot see them yet.1

• In Progress: The manager launches the assignments. System owners receive automated email alerts, access a scoped dashboard containing only their questions, provide descriptions, and upload physical evidence or URLs.1

• Submitted: The respondent locks their submission, and it becomes read-only while awaiting review.1

• Changes Requested: If the reviewer finds the evidence insufficient (e.g., an expired certificate), they send it back with direct feedback. The respondent corrects the item and re-submits.1

• Closed: The requirement is finalized and marked compliant.1

3. The Continuous SecOps Journey (The Automated Journey)

For mature environments, the user journey transitions away from manual interface interaction and shifts into automated telemetry ingestion:1

• API-First Interaction: Your platform data is programmatically queried or driven using the command-line workspace tools (CLICA) or standard REST endpoints.1

• Real-Time Ingestion: A background Dispatcher Service consumes streaming JSON messages from Kafka observation topics. It intercepts technical vulnerability data or security advisories from tools like Microsoft Defender or Nessus, clusters them to minimize ticket noise, and uploads automated evidence attachments via local storage or S3 buckets.1

• Automated Quality Assurance: The X-Rays feature scans active perimeters in the background to catch data inconsistencies, missing files, or expired risk acceptances instantly, providing real-time visibility into your compliance health.1

Compliance Audit Implementation Journey ChecklistThis sequential guide establishes a lifecycle checklist for executing your first end-to-end compliance audit inside CISO Assistant, utilizing the platform's core "decoupling" and "map once, use many" architecture.1

Phase 1: Scoping & Boundary Design

Before launching an audit, you must establish an isolated environment layout to secure data access controls:1

• Create the Domain Folder: Navigate to Domains and build your top-level department folder or client workspace.1

• Define the Perimeter Scope: Create a new Perimeter (e.g., "SaaS Production Scope") and attach it directly to your newly created domain to isolate assessment variables.1

• Populate Core Assets: Onboard your Primary Assets (business data, workflows) and map their direct connections to your Supporting Assets (underlying tech stack, cloud endpoints).1

• Import the Target Framework: Head to Governance → Library, select your standard (e.g., urn:intuitem:risk:library:iso27001-2022), and import it into your instance.1

Phase 2: Audit Initialization

• Generate the Compliance Assessment Container: Create the formal audit record, linking your loaded framework directly to your targeted Perimeter.1

• Enable Quality Control Flags: Ensure the global X-rays feature flag is active in system settings to run continuous data integrity checks.

Phase 3: The Collaborative Assignment Workflow (Human Journey)

Delegate compliance requirements across your engineering and operations squads:1

• Staging (Draft State): Select specific control groups from the framework tree and assign them to corporate team member emails (Actors), leaving them hidden while finalizing parameters.1

• Launch (In Progress State): Trigger Start or Start All to send automated notification emails to respondents, opening their scoped dashboards.1

• Evidence Collection: Respondents assess individual requirements, document operational descriptions, and upload physical evidence files or external URLs.1

• Review and Submission: Respondents confirm all requirements are assessed and click Submit for Review, locking the assessment into a read-only state.1

• Manager Triage: GRC managers select Review Responses to view the exact scoped auditee view. They then select either:1

  • Close: Finalizes the task and marks the control complete.1

  • Request Changes: Appends direct observation feedback and opens the record back up to the respondent for correction.1

• 
  

Phase 4: Cross-Framework Mapping Optimization

Leverage your collected compliance findings across alternative company audits without duplicating effort:1

• Execute "Map From an Audit": Open a separate, empty target audit (e.g., a newly created SOC 2 assessment) and select the Apply Mapping action.1

• Select the Inbound Source: Pick your mature source audit (the ISO 27001 assessment you completed in Phase 3).1

• Preflight & Preview Analysis: Review the projected compliance distribution differences and the per-requirement diff matrix before confirming.1

• Merge Execution: Confirm the merge. CISO Assistant applies a "weakest-link" multi-hop coverage model, automatically mapping your active controls, exceptions, and observations without clobbering existing target fields.1

Phase 5: Continuous Assurance & Maintenance

• Execute X-Rays Remediation: Navigate to the /x-rays view and look under the Compliance tab. Address critical warnings before moving forward—specifically filtering out any requirements marked "Compliant" that lack supporting files or linked applied controls.

• Track Exceptions: For any identified gaps, log a formal Security Exception complete with a strict expiration tracking date to prevent permanent security regression.