Skip to content

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +70 frameworks worldwide with auto-mapping: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber, NCSC, ECC, SCF and so much more

License

Unknown, AGPL-3.0 licenses found

Licenses found

Unknown
LICENSE.md
AGPL-3.0
LICENSE-AGPL.txt
Notifications You must be signed in to change notification settings

intuitem/ciso-assistant-community

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation


intuitem.com ยท SaaS Free trial ยท Docs ยท Discord ยท Frameworks

Backend code coverage API Tests Functional Tests

CISO Assistant brings a different take to GRC and Cyber Security Posture Management:

  • by explicitly decoupling compliance from cybersecurity controls implementation
  • has built-in standards, security controls and threats
  • risk assessment and remediation plan follow-up
  • allows to manage a catalog for security controls and threats
  • you can bring your own framework as well using a simple syntax
  • manage audit, evidences collection and report generation

Our vision is to provide a one stop shop for cyber security posture management and cover the layers of GRC (Governance, Risk and Compliance). As practitioners interacting with multiple cybersecurity and IT professionals, we have struggled with fragmentation and lack of efficient tooling. We keep improving CISO Assistant with anything that could bring clarity and productivity to cybersecurity teams and reduce the effort of research, audit management and paperwork.

CyberSecurity teams need to use GRC as a foundation to structure their program and implement the right tools and processes to mitigate the risks, and leave the rest to CISO Assistant ๐Ÿ™

The vision of the tool is based on this model:

The full details are available in the data model.

The decoupling allows you to save a considerable amount of time:

  • reuse previous assessments,
  • assess a scope against multiple frameworks at the same time,
  • leave the reporting formatting and sanity check to CISO assistant and focus on your fixes,
  • balance controls implementation and compliance follow-up

CISO Assistant is developed and maintained by intuitem, a French ๐Ÿ‡ซ๐Ÿ‡ท company specialized in Cyber Security, Cloud and Data/AI.

Quick Start ๐Ÿš€

Tip

The easiest way to get started is through the free trial of cloud instance available here.

Alternatively, once you have Docker and Docker-compose installed, on your workstation or server, clone the repo and run:

./docker-compose.sh

Note

The docker-compose script uses prebuilt Docker images supporting most of the standard hardware architecture. If you're using Windows, Make sure to have WSL installed and trigger the script within a WSL command line. It will feed Docker Desktop on your behalf.

Warning

If you're getting warnings or errors about image's platform not matching host platform, raise an issue with the details and we'll add it shortly after. You can also use docker-compose-build.sh instead (see below) to build for your specific architecture.

End-user Documentation

Check out the online documentation on https://intuitem.gitbook.io/ciso-assistant.

Supported frameworks ๐Ÿ™

  1. ISO 27001:2022 ๐ŸŒ
  2. NIST Cyber Security Framework (CSF) v1.1 ๐Ÿ‡บ๐Ÿ‡ธ
  3. NIST Cyber Security Framework (CSF) v2.0 ๐Ÿ‡บ๐Ÿ‡ธ
  4. NIS2 ๐Ÿ‡ช๐Ÿ‡บ
  5. SOC2 ๐Ÿ‡บ๐Ÿ‡ธ
  6. PCI DSS 4.0 ๐Ÿ’ณ
  7. CMMC v2 ๐Ÿ‡บ๐Ÿ‡ธ
  8. PSPF ๐Ÿ‡ฆ๐Ÿ‡บ
  9. GDPR checklist from GDPR.EU ๐Ÿ‡ช๐Ÿ‡บ
  10. Essential Eight ๐Ÿ‡ฆ๐Ÿ‡บ
  11. NYDFS 500 with 2023-11 amendments ๐Ÿ‡บ๐Ÿ‡ธ
  12. DORA ๐Ÿ‡ช๐Ÿ‡บ
  13. NIST AI Risk Management Framework ๐Ÿ‡บ๐Ÿ‡ธ๐Ÿค–
  14. NIST SP 800-53 rev5 ๐Ÿ‡บ๐Ÿ‡ธ
  15. France LPM/OIV rules ๐Ÿ‡ซ๐Ÿ‡ท
  16. CCB CyberFundamentals Framework ๐Ÿ‡ง๐Ÿ‡ช
  17. NIST SP-800-66 (HIPAA) ๐Ÿฅ
  18. HDS/HDH ๐Ÿ‡ซ๐Ÿ‡ท
  19. OWASP Application Security Verification Standard (ASVS) ๐Ÿ
  20. RGS v2.0 ๐Ÿ‡ซ๐Ÿ‡ท
  21. AirCyber โœˆ๏ธ๐ŸŒ
  22. Cyber Resilience Act (CRA) ๐Ÿ‡ช๐Ÿ‡บ
  23. TIBER-EU ๐Ÿ‡ช๐Ÿ‡บ
  24. NIST Privacy Framework ๐Ÿ‡บ๐Ÿ‡ธ
  25. Tisax ๐Ÿš˜
  26. ANSSI hygiene guide ๐Ÿ‡ซ๐Ÿ‡ท
  27. Essential Cybersecurity Controls (ECC) ๐Ÿ‡ธ๐Ÿ‡ฆ
  28. CIS Controls v8*
  29. CSA CCM (Cloud Controls Matrix)*
  30. FADP (Federal Act on Data Protection) ๐Ÿ‡จ๐Ÿ‡ญ
  31. NIST SP 800-171 rev2 ๐Ÿ‡บ๐Ÿ‡ธ
  32. ANSSI : recommandations de sรฉcuritรฉ pour un systรจme d'IA gรฉnรฉrative ๐Ÿ‡ซ๐Ÿ‡ท๐Ÿค–
  33. NIST SP 800-218: Secure Software Development Framework (SSDF) ๐Ÿ–ฅ๏ธ
  34. GSA FedRAMP rev5 โ˜๏ธ๐Ÿ‡บ๐Ÿ‡ธ
  35. Cadre Conformitรฉ Cyber France (3CF) โœˆ๏ธ๐Ÿ‡ซ๐Ÿ‡ท

Note

* These frameworks require an extra manual step of getting the latest Excel sheet through their website as their license prevent direct usage.


Checkout the library and tools for the Domain Specific Language used and how you can define your own.

Coming soon

  • FBI CJIS
  • BSI-IT (as requested by the German community)
  • CCPA
  • AI Act
  • Part-IS
  • SecNumCloud
  • SOX
  • MASVS
  • NIST 800-82
  • NCSC Cyber Assessment Framework (CAF)
  • UK Cyber Essentials
  • and much more: just ask on Discord. If it's an open standard, we'll do it for you, free of charge ๐Ÿ˜‰

Add your own library (framework, threat catalog, reference controls catalog or matrix)

Have a look in the tools directory and its dedicated readme. The convert_library.py script will help you create your library from a simple Excel file. A typical framework can be ingested in a few hours.

You will also find some specific converters in the tools directory (e.g. for CIS or CCM Controls).

Community

Join our open Discord community to interact with the team and other GRC experts.

Testing the cloud version

The fastest and easiest way to get started is through the free trial of cloud instance available here.

Testing locally ๐Ÿš€

To run CISO Assistant locally in a straightforward way, you can use Docker compose.

  1. Update docker

Make sure you have a recent version of docker (>= 25.0).

  1. Clone the repository
git clone git@github.com:intuitem/ciso-assistant-community.git
cd ciso-assistant-community
  1. Launch docker-compose script for prebuilt images:
./docker-compose.sh

Alternatively, you can use this variant to build the docker images for your specific architecture:

./docker-compose-build.sh

When asked for, enter your email and password for your superuser.

You can then reach CISO Assistant using your web browser at https://localhost:8443/

For the following executions, use "docker compose up" directly.

Tip

If you want a fresh install, simply delete the db directory, (default: backend/db) where the database is stored.

Docker-compose on remote

For docker setup on a remote server or hypervisor, checkout the specific instructions here

Setting up CISO Assistant for development

Requirements

  • Python 3.11+
  • pip 20.3+
  • node 18+
  • npm 10.2+

Running the backend

  1. Clone the repository.
git clone git@github.com:intuitem/ciso-assistant-community.git
cd ciso-assistant-community
  1. Create a file in the parent folder (e.g. ../myvars) and store your environment variables within it by copying and modifying the following code and replace "<XXX>" by your private values. Take care not to commit this file in your git repo.

Mandatory variables

All variables in the backend have handy default values.

Recommended variables

export DJANGO_DEBUG=True

# Default url is set to http://localhost:5173 but you can change it, e.g. to use https with a caddy proxy
export CISO_ASSISTANT_URL=https://localhost:8443

# Setup a development mailer with Mailhog for example
export EMAIL_HOST_USER=''
export EMAIL_HOST_PASSWORD=''
export DEFAULT_FROM_EMAIL=ciso-assistant@ciso-assistantcloud.com
export EMAIL_HOST=localhost
export EMAIL_PORT=1025

Other variables

# CISO Assistant will use SQLite by default, but you can setup PostgreSQL by declaring these variables
export POSTGRES_NAME=ciso-assistant
export POSTGRES_USER=ciso-assistantuser
export POSTGRES_PASSWORD=<XXX>
export POSTGRES_PASSWORD_FILE=<XXX>  # alternative way to specify password
export DB_HOST=localhost
export DB_PORT=5432  # optional, default value is 5432

# Add a second backup mailer
export EMAIL_HOST_RESCUE=<XXX>
export EMAIL_PORT_RESCUE=587
export EMAIL_HOST_USER_RESCUE=<XXX>
export EMAIL_HOST_PASSWORD_RESCUE=<XXX>
export EMAIL_USE_TLS_RESCUE=True

# You can define the email of the first superuser, useful for automation. A mail is sent to the superuser for password initialization
export CISO_SUPERUSER_EMAIL=<XXX>

# By default, Django secret key is generated randomly at each start of CISO Assistant. This is convenient for quick test,
# but not recommended for production, as it can break the sessions (see
# this [topic](https://stackoverflow.com/questions/15170637/effects-of-changing-djangos-secret-key) for more information).
# To set a fixed secret key, use the environment variable DJANGO_SECRET_KEY.
export DJANGO_SECRET_KEY=...

# Logging configuration
export LOG_LEVEL=INFO # optional, default value is INFO. Available options: DEBUG, INFO, WARNING, ERROR, CRITICAL
export LOG_FORMAT=plain # optional, default value is plain. Available options: json, plain
  1. Choose the tool of your choice, either python-venv or virtualenv. For example:
# Install python-venv
sudo apt install python-venv # or python3-venv
# Create the virtual environment venv
python -m venv venv # or python3 -m venv venv
# To enter inside the virtual environment
source venv/bin/activate
# If you want to exit the virtual environment once finished
deactivate
  1. Install required dependencies.
pip install -r requirements.txt
  1. Recommended: Install the pre-commit hooks.
pre-commit install
  1. If you want to setup Postgres:
  • Launch one of these commands to enter in Postgres:
    • psql as superadmin
    • sudo su postgres
    • psql
  • Create the database "ciso-assistant"
    • create database ciso-assistant;
  • Create user "ciso-assistantuser" and grant it access
    • create user ciso-assistantuser with password '<POSTGRES_PASSWORD>';
    • grant all privileges on database ciso-assistant to ciso-assistantuser;
  1. Apply migrations.
python manage.py migrate
  1. Create a Django superuser, that will be CISO Assistant administrator.

If you have set a mailer and CISO_SUPERUSER_EMAIL variable, there's no need to create a Django superuser with createsuperuser, as it will be created automatically on first start. You should receive an email with a link to setup your password.

python manage.py createsuperuser
  1. Run development server.
python manage.py runserver
  1. Configure the git hooks for generating the build name.
cd .git/hooks
ln -fs ../../git_hooks/post-commit .
ln -fs ../../git_hooks/post-merge .

Running the frontend

  1. cd into the frontend directory
cd frontend
  1. Install dependencies
npm install
  1. Start a development server (make sure that the django app is running)
npm run dev
  1. Reach the frontend on http://localhost:5173

Note

Safari will not properly work in this setup, as it requires https for secure cookies. The simplest solution is to use Chrome or Firefox. An alternative is to use a caddy proxy. This is the solution used in docker-compose, so you can use it as an example.

  1. Environment variables

All variables in the frontend have handy default values.

If you move the frontend on another host, you should set the following variable: PUBLIC_BACKEND_API_URL. Its default value is http://localhost:8000/api.

When you launch "node server" instead of "npm run dev", you need to set the ORIGIN variable to the same value as CISO_ASSISTANT_URL in the backend (e.g. http://localhost:3000).

Managing migrations

The migrations are tracked by version control, https://docs.djangoproject.com/en/4.2/topics/migrations/#version-control

For the first version of the product, it is recommended to start from a clean migration.

Note: to clean existing migrations, type:

find . -path "*/migrations/*.py" -not -name "__init__.py" -delete
find . -path "*/migrations/*.pyc"  -delete

After a change (or a clean), it is necessary to re-generate migration files:

python manage.py makemigrations
python manage.py migrate

These migration files should be tracked by version control.

Test suite

To run API tests on the backend, simply type "pytest" in a shell in the backend folder.

To run functional tests on the frontend, do the following actions:

  • in the frontend folder, launch the following command:
tests/e2e-tests.sh

The goal of the test harness is to prevent any regression, i.e. all the tests shall be successful, both for backend and frontend.

Setting CISO Assistant for production

The docker-compose.yml highlights a relevant configuration with a Caddy proxy in front of the frontend.

Set DJANGO_DEBUG=False for security reason.

Note

The frontend cannot infer the host automatically, so you need to either set the ORIGIN variable, or the HOST_HEADER and PROTOCOL_HEADER variables. Please see the sveltekit doc on this tricky issue.

Note

Caddy needs to receive a SNI header. Therefore, for your public URL (the one declared in CISO_ASSISTANT_URL), you need to use a FQDN, not an IP address, as the SNI is not transmitted by a browser if the host is an IP address. Another tricky issue!

Built With ๐Ÿ’œ

  • Django - Python Web Development Framework
  • SvelteKit - Frontend framework
  • Gunicorn - Python WSGI HTTP Server for UNIX
  • Caddy - The coolest reverse Proxy
  • Gitbook - Documentation platform
  • PostgreSQL - Open Source RDBMS
  • SQLite - Open Source RDBMS
  • Docker - Container Engine
  • inlang - The ecosystem to globalize your software

Security

Great care has been taken to follow security best practices. Please report any issue to security@intuitem.com.

License

AGPLv3

About

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +70 frameworks worldwide with auto-mapping: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber, NCSC, ECC, SCF and so much more

Topics

Resources

License

Unknown, AGPL-3.0 licenses found

Licenses found

Unknown
LICENSE.md
AGPL-3.0
LICENSE-AGPL.txt

Code of conduct

Security policy

Stars

Watchers

Forks

Packages