Product tour

CISO Assistant, screen by screen

Real screens from a demo instance, from the analytics dashboard to the API.

Analytics

Your whole program on one screen

Controls by status, compliance across active audits and the progress of every audit.

CISO Assistant analytics dashboard with control counts, compliance tiles, a NIST CSF radar and audit progress bars

Library

Start from a library, not a blank page

More than 200 frameworks, from NIS2 and its national transpositions to ISO and NIST, plus mappings, risk matrices, threat catalogs, reference controls and workflows, loaded in one click.

CISO Assistant library catalog filtered on NIS2, with frameworks from several countries and languages

Library builder

Write your own frameworks and forms

Author a framework, a risk matrix or a quick form in a visual editor, or import an existing one and adapt it, then publish it like any library in the catalog.

Library builder editing the CyberFundamentals Small framework, with its table of contents, a requirement and its maturity scale

Audits

An ISO 27001 audit from start to finish

Compliance and progress at a glance, flash mode and table mode for fast assessment, and the action plan and evidence one click away.

ISO 27001:2022 audit in CISO Assistant with compliance and progress charts and power-ups

Mappings

Reuse an audit on another framework

Map an ISO 27001 audit onto the SCF baseline: preview the projected compliance and every changed requirement before you confirm.

Mapping preview from ISO 27001 to the SCF baseline showing current and projected compliance

Control reuse

One control, many frameworks

A single multi-factor authentication control answers requirements in ISO 27001, NIS2, NIST CSF 2.0 and the SCF at once.

Multi-factor authentication control linked to requirements from several frameworks

Applied controls

The action plan, in the view that suits you

Every control with its priority, status, owner, ETA, effort and the assets it protects. Work from the filterable table, the kanban board, flash mode or the analytics.

Kanban board of applied controls by status with priority, progress and ETA on each card

Tasks and evidence

Recurring checks that collect their own evidence

Schedule recurring tasks, every week, month or quarter. Each occurrence asks for the evidence it expects, and the history shows at a glance which ones are completed, pending or cancelled.

Recurring task every two weeks with its next occurrence, expected evidence and a colour-coded occurrence history

Risk assessment

Risk scenarios on the matrix you choose

Every scenario placed on your matrix before and after treatment. Here the EBIOS RM 4×4 grid; ISO 27005 5×5 and your own matrices work the same way.

Current and residual risk matrices on the EBIOS RM 4x4 grid with risk scenarios placed in their cells

Quantitative risk

Know what each control is worth

Simulate losses in euros, then compare treatment options by their cost and their return: here, €132K of controls cut the expected annual loss from €379K to €72K, a 133% return on security investment.

Quantitative risk hypothesis with annualised loss expectancy, treatment cost, a 133% ROSI with its calculation, a loss exceedance curve and value-at-risk figures

EBIOS RM

ANSSI's method, workshop by workshop

The five EBIOS RM workshops and their activities in one study, from the security baseline to the risk treatment and its report.

EBIOS RM study showing the workshops and their activities

Third parties

See which vendors fall short

Rank third parties on your own criticality scale, set a compliance target per tier and see at a glance which vendors are below it, in a tier list, lanes or a quadrant.

Vendor posture tier list: each vendor’s questionnaire score against the compliance target of its tier, split into below and meets target

Vendor questionnaires

Vendors answer in their own portal

Each third party gets its own access to the questionnaires sent to it: it answers question by question, attaches evidence and submits for review. Your team then reviews the answers and turns the gaps into an action plan.

Vendor due diligence questionnaire as the vendor sees it, with a question, its answer options, progress and a Submit for Review button

DORA

Your DORA Register of Information, checked before you file

Your vendors, contracts and ICT services become the DORA Register of Information. A validation pass flags every missing field before export, with a link to fix each one.

DORA Register of Information validation summary with errors, warnings and passed checks, and the first errors with a Fix link

Privacy

Your GDPR register, at a glance

Processings, personal data categories, recipients and transfers outside the EU, data subject requests, breaches and DPIAs, kept in the same tool as the rest of your program.

Privacy overview with counts of data categories, processings, recipients, requests and breaches, a world map of data transfers and a treemap of personal data categories

Workflows

Automate the routine work

A visual builder with schedules, webhooks and events as triggers, then conditions, loops and actions on any object. Here, a daily run marks lapsed security exceptions as expired and emails the list.

Workflow builder canvas with a daily trigger, a loop over lapsed exceptions, an update action and an email action

Feature flags

As light or as complete as you need

Turn modules on or off to fit the organisation: a small team can start with the essentials, a large one can open everything. Presets get you going in one click.

Feature flag settings with 48 of 59 modules enabled, presets and modules grouped by area

API

A REST API for everything you see

Automate imports, exports and reporting through the documented REST API, and connect your own tools.

OpenAPI documentation of the CISO Assistant REST API

Try it on your own data

Open a free trial instance and walk through these screens with your own frameworks, risks and controls.

Start a free trial
Compare editions