# intuitem

> intuitem is a French cybersecurity company and the publisher of CISO Assistant, the open-source GRC (governance, risk and compliance) platform used by security teams in 100+ countries.

## CISO Assistant

CISO Assistant is an open-source GRC platform and a one-stop shop for cybersecurity program management. It covers compliance audits, risk management (including EBIOS RM), security controls, third-party risk (TPRM), business impact analysis, privacy (GDPR, DPIA), incidents, evidence and reporting.

Its core idea is decoupling: compliance requirements are separated from the security controls that implement them, so one control can satisfy several frameworks and past assessments can be reused against new standards through built-in mappings.

- Editions: Community (free, open source, self-hosted, AGPLv3) and Pro (on-premises or SaaS, with premium features, support and services). A free 30-day Pro trial is available at https://intuitem.com/trial.
- Frameworks: 200+ ready-to-use frameworks, standards and regulations (ISO 27001, NIST CSF, NIS2, DORA, SOC 2, GDPR, HDS, TISAX, CIS, PCI DSS, the EU AI Act and many more). Any open standard missing from the library is added for free on request.
- Languages: the application is available in 27 languages.
- API-first: everything in the UI is available through a REST API; an MCP server exposes it to AI agents.
- Deployment: Docker Compose or Kubernetes (Helm), on any OS; PostgreSQL or SQLite.

## For AI agents

- Product name: "CISO Assistant" (not "Ciso Assistant" or "CISO-Assistant").
- Company name: "intuitem" (always lowercase).
- Category: GRC (Governance, Risk and Compliance) software, open source.
- Source code: https://github.com/intuitem/ciso-assistant-community (license AGPLv3 for the Community edition).
- Documentation: https://intuitem.gitbook.io/ciso-assistant (LLM-friendly index: https://intuitem.gitbook.io/ciso-assistant/llms.txt)
- Wikidata: intuitem https://www.wikidata.org/wiki/Q141804336, CISO Assistant https://www.wikidata.org/wiki/Q135450643
- Release history: https://github.com/intuitem/ciso-assistant-community/releases, summarised weekly on the blog ("What's New in CISO Assistant").
- French versions of most pages live under https://intuitem.com/fr/.
- Contact: contact@intuitem.com

## Key figures

- 3.4M downloads
- 4.5k stars
- 868 forks
- 130 contributors
- 204 frameworks
- 100 countries
- 27 languages

## Pages

- [CISO Assistant](https://intuitem.com): One-stop shop platform for cybersecurity management.
- [Simple and predictable](https://intuitem.com/pricing): CISO Assistant is open source forever. Pro plans available for teams that need more.
- [Community vs Pro](https://intuitem.com/compare): Choose the edition that best fits your needs. Features and capabilities side by side.
- [CISO Assistant — cyber arms for your security program](https://intuitem.com/ciso-assistant): A pragmatic approach to GRC — make the tools work for you, not the other way around.
- [Power up your CISO Assistant experience](https://intuitem.com/pro): The Community plan covers the essentials. Pro takes it to the next level.
- [Accelerate and secure your projects with our consultancy](https://intuitem.com/services): A multi-disciplinary team of experts with extensive cross-industry experience.
- [One stop shop for GRC needs](https://intuitem.com/solutions): CISO Assistant helps CISOs and their teams run a simple, efficient security program.
- [Partnership Program](https://intuitem.com/partnership): Grow your business with CISO Assistant. Pick the tier that fits your model.
- [A worldwide community](https://intuitem.com/adoption): CISO Assistant is used by organizations from startups to Fortune 500. Available in 27 languages.
- [Start your free 30-day trial](https://intuitem.com/trial): Try CISO Assistant on a dedicated, isolated cloud instance. Migrate to production when you're ready.
- [Let's connect](https://intuitem.com/contact): Looking for a quote or just have a question? We're here to help.
- [Frequently asked questions](https://intuitem.com/faq): Answers about CISO Assistant: editions, pricing, deployment, frameworks, languages, security and support.
- [intuitem](https://intuitem.com/about): A French company specialized in cybersecurity and infrastructure management.
- [Notes on cybersecurity, GRC and open source](https://intuitem.com/blog): Research, release notes, and field reports from the intuitem team.
- [Talks & demos](https://intuitem.com/replays): Watch past webinars, conference talks, and product walkthroughs.
- [Upcoming events](https://intuitem.com/events): Where to meet the intuitem team next.
- [Our philosophy](https://intuitem.com/philosophy): How we think about cybersecurity, product, and the people we build for.
- [Diversity at intuitem](https://intuitem.com/diversity): Building a team that reflects the people we serve.
- [Security Assurance Plan](https://intuitem.com/security): How we protect customer data and operate CISO Assistant securely.
- [Service Level Objectives](https://intuitem.com/service-level-objectives): Our public commitments on availability and performance.
- [Privacy Policy](https://intuitem.com/privacy): How we collect, use, and protect your personal data.
- [Terms and Conditions](https://intuitem.com/terms): The terms that govern your use of intuitem services.
- [Conditions Générales d'Utilisation](https://intuitem.com/cgu): Les conditions qui régissent votre utilisation des services intuitem.

## Recent blog posts

All posts: https://intuitem.com/blog — RSS: https://intuitem.com/rss.xml

- [What's New in CISO Assistant — Week 44, 2026 (v4.1.2)](https://intuitem.com/whats-new-ciso-assistant-2026-w44) (2026-10-17): v4.1.2 brings DPIA screening and assessment for GDPR, a processor register, computed metrics built from metric instances, a dependency analysis for business impact analyses, a single mail service with failover, OAuth for audit-log forwarding to Microsoft Sentinel, Plumber imports into technical postures, MCP tools for incidents and evidence, and new libraries: Hungarian NIS2, Costa Rica BCCR-SINPE NT-RCS and a question-based NCSC CAF.
- [What's New in CISO Assistant — Week 43, 2026 (v4.1.1)](https://intuitem.com/whats-new-ciso-assistant-2026-w43) (2026-10-10): v4.1.1 adds vendor tiering backed by scored criticality forms, outcome rules on frameworks that check the CyFun 2025 conformity criteria, an export to the official CCB CyFun tools, paginated external APIs and bulk writes in workflows, an experimental domain compliance tree, more MCP coverage (advanced EBIOS RM, assets, teams), and new libraries: China PIPL, OWASP SAMM v2.2, ISO 27001 ↔ HDS and IEC 62443 ↔ ANSSI mappings.
- [What's New in CISO Assistant — Week 42, 2026 (v4.1.0)](https://intuitem.com/whats-new-ciso-assistant-2026-w42) (2026-10-04): v4.1.0 brings a large rework of the EBIOS RM module (study framing, RO/TO radar, standard and advanced likelihood methods on kill-chain steps), arithmetic in workflows with a CEL compute action, MCP write tools for a full risk review, a delegated user-creator role, entity-assessment exports, the BSI C5:2026 framework, German email templates, and a breaking change to the current-user API.
- [What's New in CISO Assistant — Week 41, 2026 (v4.0.8 – v4.0.9)](https://intuitem.com/whats-new-ciso-assistant-2026-w41) (2026-10-01): v4.0.8 and v4.0.9 let you set a custom score scale on an audit without cloning its framework, bring the SCF 2026.3 framework and a proper ASD Essential Eight (November 2023) model, make every linked-object tab on applied controls able to link existing objects, load long autocomplete lists in batches, and fix a seat-count regression that made readers count as editors.
- [What's New in CISO Assistant — Week 40, 2026 (v4.0.7)](https://intuitem.com/whats-new-ciso-assistant-2026-w40) (2026-09-27): v4.0.7 brings an in-app notification centre, a risk trajectory view that plays a risk assessment forward in time, X-rays that cover governance and operations and point at active controls with no evidence behind them, per-user module visibility, Mermaid diagrams in documents and PDFs, and workflows that can draft and review documents.
- [The bug that only lives between 64 and 128 KB](https://intuitem.com/bug-between-64-and-128-kb) (2026-09-26): Our frontend crashed only when a response was just big enough, and stress-testing it with far more data made the bug disappear. The story of an uncatchable undici assertion, a 64 to 128 KB window, and the one-line gunicorn detail that hid it from our laptops.
- [What's New in CISO Assistant — Week 39, 2026 (v4.0.5 – v4.0.6)](https://intuitem.com/whats-new-ciso-assistant-2026-w39) (2026-09-21): v4.0.5 lands a mapping table beside the graph, relation graphs on detail pages, a command palette that can now search and create, workflow steps that record measurements and file scan results — and a Power BI connector release that anyone who upgraded to 4.0 needs to install. v4.0.6 follows with an evidence-upload fix worth taking straight away.
- [What's New in CISO Assistant — Week 38, 2026 (v4.0.4)](https://intuitem.com/whats-new-ciso-assistant-2026-w38) (2026-09-16): A single patch after the busy 4.0.2/4.0.3 pair — but it carries a real behaviour change for dynamic frameworks, honest loading states on list views, and a container-hardening step that operators need to read before upgrading.
- [What's New in CISO Assistant — Week 37, 2026 (v4.0.2 – v4.0.3)](https://intuitem.com/whats-new-ciso-assistant-2026-w37) (2026-09-14): The first two patches after 4.0 are anything but quiet: quick forms turn ad-hoc requests into a real intake channel, every PDF export moves onto one engine, the audit table-mode is rebuilt, workflows gain AI steps, and a focused performance push targets the pages that were slowest to load.
- [What's New in CISO Assistant — Week 36, 2026 (v3.21.4 – v4.0.1)](https://intuitem.com/whats-new-ciso-assistant-2026-w36) (2026-09-06): CISO Assistant reaches 4.0. The headline is a large findings and third-party risk epic — binders, commitments, campaigns, external ratings — landing alongside JIT SSO provisioning, a reworked tasks and evidence module, and a pagination contract that API consumers will want to read before upgrading.
- [What's New in CISO Assistant — Week 35, 2026 (v3.21.3)](https://intuitem.com/whats-new-ciso-assistant-2026-w35) (2026-08-27): The workflow engine learns to write: an update action with a hard-coded integrity line, date-aware scheduling, and bulk edits that finally emit events. Plus the UNESCO AI Maturity Framework, a feature-flag cache, and a long run of fixes across exports, search, permissions and the framework builder.
- [When your AI confidently miscounts your risk register](https://intuitem.com/ciso-assistant-mcp-architecture) (2026-08-22): We rebuilt the CISO Assistant MCP server: 105 tools instead of a hand-written long tail, exact server-side counts instead of row-counting, and an HTTP transport that is read-only by default. Notes on what breaks when you hand a GRC platform to an agent.
- [What's New in CISO Assistant — Week 34, 2026 (v3.21.1 – v3.21.2)](https://intuitem.com/whats-new-ciso-assistant-2026-w34) (2026-08-21): A SCIM account-takeover chain closed, the IAM permission engine rewritten on querysets to lift a hard scaling ceiling, a new aggregated MCP architecture with HTTP transport, and a streamlined approval management interface. Plus manual score overrides, per-template email toggles, and the ISO 27701:2025 outline.
- [What's New in CISO Assistant — Week 32, 2026 (v3.20.5 – v3.21.0)](https://intuitem.com/whats-new-ciso-assistant-2026-w32) (2026-08-09): A big week: threat modeling with TTP catalogs and MITRE ATLAS, a full workflow engine with a visual builder, customizable asset classes rendered as a tree, and service accounts for machine-to-machine API access. Plus a breaking change on implementation groups, evidence previews for a dozen file types, and four new libraries.
- [What's New in CISO Assistant — Week 31, 2026 (v3.20.3 – v3.20.4)](https://intuitem.com/whats-new-ciso-assistant-2026-w31) (2026-07-29): A native Power BI connector ships as a signed, standalone artifact, third-party risk management joins domain export/import, posture management gains observations and attachments, and the AI chat learns to import spreadsheets. Plus the TISAX v2027 and ENISA SME cyber resilience frameworks, Slovenian localization, and an IAM hardening fix.

## Supported frameworks (171 listed here, 200+ in the library)

Full list: https://intuitem.com/frameworks

ENISA 5G Security Controls Matrix; intuitem Agile Security Framework (ASF) Baseline; European Commission AI Act; Lenny Zeltser & Sounil Yu AI Defense Matrix; NIST AI Risk Management Framework (AI RMF); Boost Aerospace AirCyber; Ministry of Defence of the Netherlands Algemene Beveiligingseisen voor Defensieopdrachten (ABDO) 2019; Government of the Netherlands Algemene Beveiligingseisen voor Rijksoverheidsopdrachten (ABRO) 2026; ANSSI - Certification PASSI; ANSSI - Cybersécurité des systèmes industriels - Mesures détaillées; ANSSI - Questionnaire MonAideCyber; ANSSI - Recommandations de configuration d'un système GNU/Linux; ANSSI - Recommandations de sécurité relatives à TLS; ANSSI - Recommandations pour l'architecture d'un système de journalisation; ANSSI - Recommandations pour la protection des SI essentiels; OWASP Application Security Verification Standard (ASVS); ANSSI Autoévaluation de gestion de crise cyber; Government of the Netherlands Baseline informatiebeveiliging Overheid 2 (BIO2); T.C. CBDDO Bilgi ve İletişim Güvenliği Rehberi (BİGR); DGAC/DSAC Cadre Conformité Cyber France (3CF) v1 2021; DGAC/DSAC Cadre Conformité Cyber France (3CF) v2 2024; DGAC/DSAC Cadre Conformité Cyber France (3CF) v3.1 2026; ANSSI Cahier des charges Label EBIOS RM v3.1; State Of California California Consumer Privacy Act (CCPA); State of California California Consumer Privacy Act Regulations; ADR & NOREA Cbw (NIS2) Control Framework v1.2; CCB CyberFundamentals Framework 2025; CCB CyberFundamentals Small - Self Assessment; European Union CER Directive (Critical Entities Resilience); ANSSI Checklist de dossier d'homologation; Oulkhabou Bassou Checklist des exigences de la Loi n° 09-08 (Maroc); CIS Benchmarks; CIS* CIS Controls v8; CISA Cybersecurity Performance Goals (CPG) v2.0; CISA Vendor Supply Chain Risk Management (SCRM) Template; Cisco Cloud Controls Framework (CCF) v3.0; FBI CJIS Security Policy; Clausier de sécurité numérique du Club RSSI Santé; BSI Cloud Computing Compliance Criteria Catalogue (C5) 2020 and 2026; CSA* Cloud Controls Matrix (CCM); NCA Cloud Cybersecurity Controls (CCC-1:2020); EU Cloud Sovereignty Framework v1.2.1; Adobe Common Controls Framework (CCF); NCSC Cyber Assessment Framework (CAF) v3.2; NCSC Cyber Assessment Framework (CAF) v4.0; NCSC Cyber Essentials; European Union Cyber Resilience Act (CRA); ECB Cyber resilience oversight expectations for financial market infrastructures; NIST Cyber Security Framework; CCB CyberFundamentals Framework; NIST CyberSecurity Framework (CSF); DoD (US) Cybersecurity Maturity Model Certification (CMMC); sikker digital De tekniske minimumskrav for statslige myndigheder; European Union Digital Operational Resilience Act (DORA); DGSSI Directive Nationale de la Sécurité des Systèmes d'Information (DNSSI); RIA Estonia E-ITS (Estonia's national cyber security standard) - 2024; ENISA SME Cyber Resilience Maturity Assessment; Spanish government Esquema Nacional de Seguridad (ENS); NCA Essential Cybersecurity Controls (ECC-1:2018); NCA Essential Cybersecurity Controls (ECC-2:2024); Australian Government Essential Eight Maturity Model; European Union EU Digital Identity Wallet - Architecture and Reference Framework (ARF); European Commission European Sustainability Reporting Standards (ESRS); Confédération suisse Federal Act on Data Protection; FINMA - Circular 2023/01 - Operational risks and resilience - Banks; DGA Formulaire d'évaluation de la maturité - niveau fondamental; Framework Nazionale CyberSecurity v2 (FNCS Italia); Framework Nazionale per la Cybersecurity e la Data Protection (ACN Italia); Federal Trade Commission FTC's Standards for Safeguarding Customer Information; European Union General Data Protection Regulation (GDPR); Google Secure AI Framework (SAIF); GSA FedRAMP rev5; CNIL Guide de la sécurité des données personnelles; ANSSI Guide d’hygiène informatique; ANSSI Guides des mécanismes cryptographiques; HHS/NIST Health Insurance Portability and Accountability Act (HIPAA); SZTFH (Hungary) Hungarian NIS2 audit requirements (1/2025. SZTFH rendelet); Prime Minister's Cabinet Office (Hungary) Hungarian NIS2 protective measures catalogue (7/2024. MK rendelet, annex 2); Prime Minister's Cabinet Office (Hungary) Hungarian NIS2 threat catalogue (7/2024. MK rendelet, annex 3); IEC 62443 series; ANSSI IGI 1300 / II 901 - Exigences pour la mise en œuvre d'un SI classifié; Government of India India's Digital Personal Data Protection Act (DPDPA) - 2023; US Department of state International Traffic in Arms Regulations (ITAR); ISO 22301:2019 - Business Continuity Management Systems; ISO/IEC ISO 27701:2025 - Privacy Information Management System; ISO/IEC ISO 42001:2023 - Artificial Intelligence Management System; ISO/IEC 27001:2013; ISO/IEC 27001:2022; BSI IT-Grundschutz-Kompendium; Axelos ITIL 4 Management Practices; Government of Canada ITSP.10.171 - Protecting specified information (Canada); KISA Korea ISA ISMS-P; Government of Lithuania Lithuanian NIS2 Cybersecurity Law (Kibernetinio saugumo įstatymas); Gouvernement du Maroc Loi 05-20 relative à la cybersécurité (Maroc); Royaume du Maroc Loi n° 09-08 relative à la protection des personnes physiques (Maroc); Microsoft Cloud Security Benchmark v1; Mindeststandard-des-BSI-zur-Nutzung-externer-Cloud-Dienste; Misure minime di sicurezza ICT per le pubbliche amministrazioni (AGID Italia); MITRE ATT&CK v19.1 - Threats and Mitigations Catalog; MITRE D3FEND - Reference Controls; OWASP Mobile Application Security Verification Standard (MASVS); NCA National Cybersecurity Controls for Non-CNI Private Sector Entities (NCNICC-1:2025); European Union Network and Information Security (NIS2); GCSB New Zealand New Zealand Information Security Manual (NZISM); Gouvernement Français NIS-1 transposition FR; EU NIS2 technical and methodological requirements 2024/2690; NIST 800-82 (OT) - Appendix; NIST Privacy Framework; NOREA - DORA in Control Framework v3.0; NEW YORK STATE NYDFS 500 / NYCRR; NCA Operational Technology Cybersecurity Controls; OWASP Application Security Verification Standard (ASVS) 5; OWASP MAS Threat Modelling Guide - Threat Catalog; OWASP Software Assurance Maturity Model (SAMM) v2.2; OWASP Top 10 for Agentic Applications 2026; OWASP Top 10 Web - Threat Catalog; OWASP's checklist for LLM governance and security; European Commission PART-IS; PCI Security Standards Council Payment Card Industry Data Security Standard; SDAIA Personal Data Protection Law (PDPL) - Saudi Arabia; Cyberspace Administration of China Personal Information Protection Compliance Audit Measures and Guideline (CAC); NPC (China) Personal Information Protection Law (PIPL); ANS PGSSI-S (Politique Générale de Sécurité des SI de Santé); Plumber CI/CD Security Checks; Points de contrôle Active Directory (AD) - ANSSI; NIST Post-Quantum Cryptography (PQC) Migration Roadmap; ANSSI Prestataires de détection des incidents de sécurité (PDIS); Agence du Numérique en Santé Programme CaRE - Domaine 2 (Continuité et reprise d'activité); Agence du Numérique en Santé Programme HospiConnect - HOP'EN2; Australian Government Protective Security Policy Framework; Prudential Standard CPS 230 - Operational Risk Management (APRA); Prudential Standard CPS 234 - Information Security (APRA); Gouvernement Français PSSI État; Gouvernement Français PSSI-MCAS (Ministères chargés des affaires sociales); ANSSI Bénin PSSIE du Bénin; Reserve Bank of India RBI Master Direction 2023 - India; ANSSI Recommandations de sécurité pour un système d’IA générative; ANSSI Recommandations de sécurité relatives à IPsec; ANSSI Recommandations pour les architectures des systèmes d’information sensibles ou à diffusion restreinte; ANSSI Recommandations pour un usage sécurisé d'(Open)SSH; Recommandations relatives à l'administration sécurisée des SI (ANSSI); ANSSI Recommandations relatives à l'interconnexion d'un SI à internet; ANSSI Recommandations sur la sécurisation des systèmes de contrôle d'accès physique et de vidéoprotection; Gouvernement Français Règles OIV - Secteur « Activités civiles de l'Etat » (2019); Gouvernement Français Règles OIV - Secteur « Transport aérien » (2016); ANSSI Référentiel Cyber France (ReCyF); Haute Autorité de Santé Référentiel de certification des établissements de santé pour la qualité des soins (HAS); Royaume du Maroc Référentiel des exigences de qualification des prestataires de services cloud (Maroc); ANCS Tunisie Référentiel d’Audit de la Sécurité des Systèmes d’Information; ANSSI Référentiel Général de Sécurité; ANSSI Référentiel Général de Sécurité 2.0 - Annexe B2; Agence du Numérique en Santé Référentiel Hébergeur de Données de Santé (HDS); Référentiel National de Sécurité de l'Information (RNSI), MPT Algérie; Saudi Arabian Monetary Authority (SAMA) Cybersecurity Framework; ANSSI SecNumCloud; ANSSI SecNumCloud v3.2 Annexe 2 - Recommandations aux commanditaires; SCF Council Secure Controls Framework (SCF) 2026.3; NIST Secure Software Development Framework (SSDF); AICPA SOC2-2017 Trust Services Criteria; NIST SP 800-171 revision 2; NIST SP 800-171 revision 3; NIST SP 800-53 revision 5; SWIFT Swift Customer Security Controls Framework (CSCF) v2025; FONES Swiss ICT minimum standard; ECB TIBER-EU; ENX TISAX (VDA ISA) v5.1, v6.0 and v2027; UK Ministry of Defence UK Defence Standard 05-138 Issue 4; UNESCO AI Maturity Framework; ENX Vehicle Cyber Security Audit (VCSA) v1.1; intuitem Vendor Due Diligence - Simple Baseline; U.S. Department of Defense CIO Zero Trust for Operational Technology (ZT OT)

## Optional

- [Full text for LLMs](https://intuitem.com/llms-full.txt): FAQ, framework descriptions and every blog post