CISO Assistant Reports

CISO Assistant features built-in reporting engine capabilities that complement its visual interactive views and continuous telemetry exports. Reports are designed to summarize compliance states, gap analyses, and operational statistics for auditors, internal stakeholders, and executive committees.

1. Types of Native Compliance Reports

When evaluating a specific Perimeter against a framework (such as ISO 27001, SOC 2, or NIST CSF), CISO Assistant generates structured summaries that present your position:1

• Gap Analysis Summary: Summarizes the ratio of "Compliant," "Partially Compliant," and "Non-Compliant" requirements within an active compliance assessment.1

• Statement of Applicability (SoA): Specifically for frameworks like ISO 27001, this report presents the catalog of in-scope and out-of-scope controls along with their technical justifications.1

• Audit Trail Records: Generates read-only records of control answers, logged observations, and verification histories to present directly to external certification bodies.1

2. Formats and Generation Channels

The platform adopts an API-first approach, enabling your team to produce and export reports across multiple channels depending on your environment profile:1

• Web UI Exports: End users can download standard formats (such as Excel spreadsheets or formatted summaries) directly from the Audits or Risk Assessments domain pages.1

• Command Line Tooling (CLICA): Power users can use CLI commands to bulk-extract compliance or risk status metadata directly into configuration files.1

• Automated Kafka Ingestion & Syndication: For large corporate architectures, report logs can be continually streamed via Kafka to secure enterprise log warehouses.1

3. Alternative to Static Reports: Real-Time Telemetry

Rather than waiting for manual document generation, CISO Assistant allows organizations to extract continuous data insights through its specialized monitoring infrastructure:1

• Embedded Quality Diagnostics (X-Rays): The platform features a continuous validation engine called X-Rays. Accessible via the frontend at /x-rays or programmatically at GET /api/perimeters/quality_check/, it automatically flags database logic issues—such as requirements marked "Compliant" that lack physical file uploads or URL references.1

• Prometheus Metrics Server: By running the standalone server command (python manage.py metrics_server), CISO Assistant exposes live telemetry counters on port 8001. This tool isolates metrics collection from core application traffic, exposing values like:1

  • ciso_assistant_nb_compliance_assessments (Total active compliance audits).1

  • ciso_assistant_nb_risk_acceptances (Signed-off security exceptions).1

  • ciso_assistant_nb_evidences (Total uploaded policy and infrastructure files).1

These real-time metrics allow security squads to connect CISO Assistant directly to visualization layers like Grafana, replacing traditional static slide decks with live, interactive executive security dashboards.1