CMDash as an alternative to CISO Assistant
Same sourced comparison as CMDash vs. CISO Assistant, framed for switching: 1 dimension below favor CMDash, 1 favor CISO Assistant — including where CISO Assistant is built to do something CMDash deliberately doesn’t.
| Dimension | CMDash | CISO Assistant |
|---|---|---|
Product category Source, verified 2026-09-11 — https://github.com/intuitem/ciso-assistant-community. May have changed since. | CISO Dashboard | Open-source GRC platform (AGPL community edition) — frameworks, risk register, compliance assessments, audit and a lite third-party register in one self-hosted app |
License cost Source, verified 2026-09-11 — https://github.com/intuitem/ciso-assistant-community/blob/main/product-docs/introduction/editions.md. May have changed since. | $1,788.00/yr (Starter tier) — hosted SaaS | Vendor advantage: Free to self-host under AGPL (the community edition this page compares against); intuitem also sells a hosted SaaS and a commercial PRO/Enterprise edition, neither of which is free |
Hosting & operations Source, verified 2026-09-11 — https://github.com/intuitem/ciso-assistant-community/blob/main/product-docs/introduction/editions.md. May have changed since. | CMDash advantage: Hosted SaaS — nothing to install, patch, or back up yourself | Self-hosted only (Docker Compose quick start, or a documented Helm chart) — you provision, patch, and back up every instance yourself; an MSP running it for clients stands up one deployment per client |
Verified against CISO Assistant’s own repository and product docs on 2026-09-11 (v4.0.1, released 2026-09-05) — see the release. 37 capabilities compared across 3 columns, plus 1 claim D1 could not verify either way (listed below, not guessed into a column).
CISO Assistant's free community edition has this — and so does CMDash Starter, today, hosted, for $149/mo.
- Framework library, several frameworks per instance — STARTER
- Requirement mappings between frameworks (crosswalks), read-only — STARTER
- Compliance assessments, requirement status and scores — STARTER
- Risk assessments: scenarios, risk matrices, risk acceptance — STARTER
- Security exceptions / risk acceptance with expiry — STARTER
- Applied controls and Statement of Applicability — STARTER
- Evidence, documents and policies as evidence — STARTER
- Third parties: entities and entity (third-party) assessments — STARTER
- Assets, asset classes, business impact analysis and continuity — STARTER
- Incidents, findings, tasks and calendar — STARTER
- Vulnerability tracking — STARTER
- Import/export (Excel/CSV) — STARTER
- REST API — STARTER
- SSO (SAML 2.0 / OIDC) — STARTER
- MFA (TOTP / WebAuthn) — STARTER
- Built-in roles and user groups — STARTER
- Report generation (audit PDF/Word/CSV) — STARTER
- Quantitative risk analysis (Monte Carlo) — STARTER
- Standing data-quality scan of assessments — STARTER
- Custom metric definitions and widget dashboards — STARTER
- Technical baselines / recurring posture scans — STARTER
CMDash has this and CISO Assistant's community edition does not.
- Audit trail / object history — STARTER
- SCIM / IdP group federation — ENTERPRISE
- Multi-domain (folders) and RBAC — ENTERPRISE
- Custom report templates — ESSENTIALS
CISO Assistant's community edition gives this away free; CMDash gates it above Starter or does not offer it — the honest gaps.
- Author or import your own framework/library — ENTERPRISE
- Reusable control implementation statements — COMMAND
- Self-hosted Docker deployment
- Multi-language UI
- Workflow automation engine with a visual builder — COMMAND
- Privacy register (GDPR): processings, personal data, DSARs, breaches
- EBIOS RM risk method (ANSSI)
- Public trust centre / read-only portal — COMMAND
- Threat modelling and MITRE ATT&CK / ATLAS TTP catalogues — COMMAND
- Outgoing webhooks — ENTERPRISE
- In-product AI chat and an MCP server — COMMAND
- Project management, accreditations and responsibility matrices — COMMAND
Not counted above — D1’s primary sources did not settle these either way: Validation / approval flows.
Open-source GRC covering 40+ frameworks.
- Young project — expect breaking changes and thin migration tooling between releases
- No employee attestation workflow to speak of
- Community support only unless you buy the commercial edition
Open-source GRC, one instance per client.
- One deployment per client is real operational overhead that grows linearly
- No cross-client practitioner console or consolidated reporting
- No billing, metering or client-branding support at all
Open-source GRC with AI framework content.
- Generic GRC treatment — no AI-specific evidence, testing or documentation model
- No discovery, no model evaluation, no regulatory intelligence
- Young project with community-only support
Hosted — nothing to install, patch, or back up yourself
Integrations fill in evidence automatically instead of manual uploads to a blank instance
A live A–F posture score and 30/90-day trend, not just a compliance percentage
A guided onboarding wizard scoped to your role, not a blank instance after setup
In-app help on every route, not just external docs
A built-in glossary for every GRC term on screen, and product tours for a first-time user
CMDash has a dedicated CISO Assistant importer. Export your frameworks/assessments, policies, evidence and risk scenarios and CMDash maps them onto its own framework catalogs, policy templates and Risk Register, reporting every line as matched, low-confidence or unmatched before it writes anything — see /switch/ciso-assistant for which columns it reads and what it cannot carry over. Third-party entities import into CMDash’s vendor register lite (5 vendors, no monitoring); vendor 6+ needs the TPRM add-on.
What a CISO Assistant export does and does not carry over — column by column, with the switching offer.
Every figure above is the same sourced, dated fact table /compare/ciso-assistant renders — nothing here is retyped for this page. Pricing and product capabilities change; think something above is wrong or out of date? Tell us and we’ll fix it.