Self-hosted GRC tools for ISO 27001: CISO Assistant vs eramba

Can a self-hosted GRC tool run your ISO 27001 risk register and Statement of Applicability?

Yes, a self-hosted GRC tool can hold your ISO 27001 risk register, applied controls, evidence and audit records, but what you get depends on the edition. CISO Assistant is an open core: its community files are licensed under AGPL-3.0, while anything inside its top-level enterprise directory falls under the proprietary intuitem Commercial Software License and needs a contract with intuitem. eramba Community is free to use, but it is not open source; its own license since a June 2024 update forbids modifying, selling, licensing or distributing the software, so you cannot treat it as a freely redistributable base. Before you commit, confirm with each vendor which features your edition includes, because the CISO Assistant README does not list which features sit in the commercial directory.

Hosting the tool does not move the accountability. Your organization still owns its risk decisions, its risk treatment choices and the controls it declares in the Statement of Applicability. A partner can install the tool in your infrastructure, configure the ISO/IEC 27001:2022 framework, load your assets, risks and existing controls, and set up evidence owners and review schedules. That work prepares the records; it does not make the risk judgments for you. Decide early who signs off on risk acceptance, who owns each applied control and which evidence each control must produce.

Only an independent accredited certification body issues an ISO 27001 certificate, and it will decide whether your register and Statement of Applicability are adequate. Ask the certification body early whether it accepts records exported from a self-hosted tool and in what format, and confirm that your edition can export the Statement of Applicability and risk treatment records in that form. Treat the tool as the place where the ISMS lives, not as proof that the ISMS works.

How CISO Assistant and eramba Community differ for ISO 27001 work

CISO Assistant ships an open framework library that includes ISO/IEC 27001:2022 and ISO/IEC 27001:2013, with a mapping between the two editions. That mapping helps a team that is still carrying a 2013 Statement of Applicability through its transition. The library also includes ISO/IEC 27701:2025, ISO 22301:2019 and a TISAX library, so one tool can hold several management system frameworks in the same workspace.

Edition mapping: The 2013 and 2022 libraries are linked, which helps reconcile older control references with the current Annex A.
Cross-framework mappings: NIST CSF 2.0, NIST SP 800-53 Rev. 5, CIS Controls v8 and SOC 2 are mapped to ISO/IEC 27001:2022, so one control can serve several audits.
Risk matrix: A 5x5 risk matrix based on ISO/IEC 27005 is included as a starting point for the risk assessment.
Library scope: Mappings are maintained in the public repository, so check each mapping against your own control set before relying on it in an audit.

Confirm with the maintainers which library version your deployment loads and whether your team has reviewed the mappings for your scope.

What CISO Assistant's ISO 27001 framework library includes

CISO Assistant ships an open framework library that includes ISO/IEC 27001:2022 and ISO/IEC 27001:2013, with a mapping between the two editions. The library also carries ISO/IEC 27701:2025 for privacy information management, ISO 22301:2019 for business continuity, and a TISAX library for automotive suppliers. For an ISMS team, the ISO 27001 entries give a starting structure: the clauses to answer and the Annex A controls to map your applied controls against. The 2013 mapping matters if you hold or inherited records written against the older control numbering, since you can trace old references to the 2022 set rather than rebuilding them by hand.

A framework library gives you the structure, not the substance. It does not decide your scope, which sites, services and systems the ISMS covers, and it does not decide which Annex A controls apply to you or why, which is the job of the Statement of Applicability you own. It also does not hold your evidence. A mapped control is only a line in a register until someone attaches a configuration export, an access review record or a signed policy, and the library cannot tell whether those artifacts are current or sufficient. Treat the library as a checklist to adapt, and keep every exclusion and risk decision in your own records.

Inspect the library before you rely on it. The files sit in the backend/library/libraries folder of the ciso-assistant-community repository on GitHub, and you can read the ISO 27001 entries directly, compare the 2013 and 2022 mappings, and check the control text your team will edit. Confirm the library version you import against the release you deploy, and confirm with intuitem which features in the product are covered by the open license and which sit in the commercial enterprise directory, because the README does not list them. Checking these points first avoids discovering a gap during the certification audit.

Which license governs each tool and what it allows you to do

The two tools come under three different licensing arrangements, and the differences decide what your team may modify, redistribute or run in production. Read each component's license before you plan a deployment, because the free edition of one tool carries restrictions the other does not.

CISO Assistant community files

Files outside the top-level enterprise directory of the CISO Assistant repository are licensed under AGPL-3.0-only. That license lets you run, study, modify and redistribute the code, but a modified version you make available to users over a network generally must be offered in source form under the same terms. Have counsel confirm how that applies if you alter the application for internal staff only. Check the LICENSE.md file in the repository before you fork or customize it.

CISO Assistant enterprise directory

Files inside the top-level enterprise directory are under the proprietary intuitem Commercial Software License, and using them requires a contract with intuitem. The README does not list which features sit in that directory. Before you rely on a specific feature, such as an advanced workflow, reporting or a third-party risk capability, ask intuitem in writing which edition includes it and whether your use is covered by the contract.

eramba Community license terms

eramba Community is free to use under eramba limited's own license, not an open-source license. Since a June 2024 update, that license forbids modifying, selling, licensing or otherwise distributing the software. Your team can use it, but it cannot fork it, resell it or ship it inside another product. Confirm with eramba that internal use across your business units and any use by contractors fall within the terms before you roll it out.

Why eramba says not open source

eramba staff state that Community should not be called open source, because the license does not permit redistribution. That position matters for procurement. If your policy, customer questionnaire or vendor register asks whether a tool is open source, answer with the license name and its restrictions, not the label. The same question applies to any tool your ISMS documents in its asset or supplier inventory.

Items for legal review before deployment

Ask counsel to review the license for each component you plan to run, the terms of any intuitem or eramba commercial contract, and whether customizations, integrations or hosting for a managed service provider create obligations. Also ask who owns the records and generated audit evidence, and how exit works if you change tools. This is a checklist for discussion with your legal team, not legal advice.

How the risk register, Statement of Applicability and audit records fit together

The sequence moves from a defined risk method to a risk register, treatment decisions, a Statement of Applicability and scheduled audit records, so each ISO 27001 artifact traces back to the one before it. Confirm in your own environment which of these objects each tool version stores before you build the workflow.

Define the risk method and scale
Before entering any risk, the ISMS owner sets the risk assessment method, including the likelihood and impact scales, the acceptance criteria and who approves risk acceptance. CISO Assistant's framework library includes a 5x5 risk matrix based on ISO/IEC 27005, which you can adopt or adjust. In eramba, you set the equivalent scales in the risk configuration. The output is a documented method that every later risk score must use. Confirm with the tool's documentation that the matrix you choose can be applied consistently to all risk types.
Record risks against assets, third parties and processes
Risk owners enter each risk against the item it affects: an information asset, a third-party supplier or a business process. CISO Assistant keeps risk assessments and risk registers, and its third-party risk module covers supplier risks. eramba's risk management module records asset, third-party and business risks. The output is a register where every risk has an owner, a score under the agreed method and a link to the item it concerns. Check that no risk is entered without an owner.
Select treatments for each risk
For each risk, the owner records the treatment decision: modify, retain, avoid or share. Risks that are retained need a documented acceptance by the person the method names. The treatment choice is the point where the register connects to controls. The output is a treatment decision on every risk, with reasons, that a reviewer can read without asking the risk owner. Confirm the exact treatment options your tool offers, since labels differ between products.
Link applied controls and evidence
Where a treatment modifies a risk, the owner links one or more applied controls to it. In CISO Assistant, applied controls, evidence and action plans for remediation are kept as separate objects tied to the risk. In eramba, each risk links to its treatment through internal controls, policies, exceptions or projects. The output is a traceable chain from risk to control to evidence. Spot-check a few risks to confirm that each link leads to a real piece of evidence, not an empty placeholder.
Build the Statement of Applicability
The ISMS owner works through the Annex A controls in the framework library, marks each as applicable or not applicable, and records a justification for both choices. Each applicable control should point to the applied controls that implement it. CISO Assistant's library includes ISO/IEC 27001:2022 and a mapping from the 2013 edition, so you can start from the current control set. The output is a Statement of Applicability that matches the risk treatments. Reconcile it against the register before management review, because a control marked applicable with no linked treatment is a common gap.
Schedule control testing
For each internal control, the control owner sets the audit methodology, the success criteria, the evidence owner and the testing schedule. eramba records these fields on each internal control and generates audit records for the current and next calendar year from them. Other tools may handle scheduling differently, so confirm how your chosen product creates and tracks test records. The output is a testing plan that names who tests what, against which criteria, and when.
Run internal audits and record results
The internal auditor, who should not be the control owner for the control under test, performs each scheduled test, attaches the evidence and records pass, fail or exception with notes. Failed tests generate action plans for remediation. The output is a dated audit record for each control, a set of open remediation items and evidence that a reviewer can trace back to the control. Confirm which parts of this workflow your edition supports, because eramba states that Awareness Programs, Automated Account Reviews and Online Assessments, plus automation, REST APIs, reporting and notifications, need the paid Enterprise edition.
Feed results into management review
Management reviews the risk register, the Statement of Applicability, open remediation items and internal audit results together. Decisions on risk acceptance, treatment changes and resourcing are recorded and fed back into the register and the Statement of Applicability. The output is a management review record that shows what was decided and which register entries changed. This closes the loop, and the records become the evidence an external certification body samples. Confirm with that body how it expects these records to be presented.

What to verify before you commit a GRC tool to an ISO 27001 project

A self-hosted GRC tool holds your risk register, Statement of Applicability and audit evidence, so its edition, license and hosting need checking before rollout. Each card below names one check to confirm with the vendor or in your own environment before you build on the tool.

Confirm edition features in writing

Feature coverage differs between editions, and the public README for CISO Assistant does not list which features sit in its commercial enterprise directory. Ask intuitem to confirm in writing which capabilities your edition includes, such as third-party risk, reporting or the modules you plan to use. Do not rely on a feature you have only seen in a demo or a marketing page. eramba's Community edition covers 4 of its 7 use cases, so check the same way for each use case you need.

Review license terms with counsel

CISO Assistant combines AGPL-3.0-only code with a proprietary commercial license for files in its enterprise directory, so the terms that apply depend on which files you run. eramba Community uses its own license, which forbids modifying, selling, licensing or distributing the software. Have counsel review whether your internal modifications, hosting for third parties or contractor access are permitted before you deploy.

Test the ISO 27001 library against your Annex A list

CISO Assistant ships an ISO/IEC 27001:2022 library and a mapping from the 2013 edition, but a library is only a starting point. Load your own Statement of Applicability list of Annex A controls, then check that each control, its attributes and its applied controls match what you actually operate. Record any gaps as decisions for your team, since the mapping and wording do not replace your own assessment.

Check exports against auditor requests

Before committing, ask your certification body which documents it will request, such as the Statement of Applicability, risk treatment records, internal audit results and evidence lists. Export a sample of each from the tool and check that the files show versions, dates, owners and approvals in a form your auditor can read. An export that only shows a screen capture or a flattened table can slow fieldwork.

Assign who runs hosting and backups

A self-hosted GRC tool becomes an in-scope system the moment it holds ISMS records, so someone must own its patching, access control, backups and restore tests. Decide whether your team, your cloud provider or an implementation partner runs these tasks, and write that split into the project scope. Confirm that backups are tested by restoring them, not only by checking that jobs complete.

Confirm data stays in your environment

Confirm that the tool stores all risk data, evidence and user records in your own cloud account, data center or air-gapped network, and that no telemetry or license check sends data to the vendor. Ask the vendor to document every outbound connection, including update checks, and verify the list on a test deployment with your network controls in place. Record the result as evidence for your data handling controls.

Questions buyers ask about self-hosted GRC tools for ISO 27001

Is a free self-hosted GRC tool enough to pass an ISO 27001 certification audit?

A free tool can hold the records an ISO 27001 audit reviews, but it cannot make the audit pass by itself. The certification body checks whether your management system works: the risk assessment, the Statement of Applicability, the evidence for each control and the internal audit and management review records. A GRC tool helps you keep those records consistently and linked. The licence matters too. eramba Community is free to use but its licence forbids modifying, selling or distributing the software, so check the terms with your legal team before you rely on it. CISO Assistant's community edition is licensed under AGPL-3.0 for most files, with a separate commercial licence for the enterprise directory, so confirm which features you need sit in the open part.

How much internal effort does a self-hosted GRC tool setup need, and what drives it?

The effort comes mostly from your own content, not from installation. Installing the tool is a technical task for your platform team. Populating it is a business task: you must define assets, owners, risk criteria, applied controls, evidence sources and the review schedule. The main drivers are the size of your scope, the number of business units and suppliers, how many systems hold evidence in other tools, and whether your team already has an asset inventory and a current risk register. Clear ownership of each control and each evidence item usually matters more than the number of users. Ask any implementer to show you the populated scope they will hand over and the list of owners who must sign off on it.

Does the ISO 27001 framework library in a GRC tool replace our own risk assessment?

No. The library gives you the clause and Annex A control structure, so you do not have to type the 93 controls from scratch. It does not know your assets, threats, suppliers or business impacts, and the risk assessment has to come from your organization. CISO Assistant includes a 5x5 risk matrix based on ISO/IEC 27005, which sets the scoring method, but you still decide the likelihood and impact for each risk and choose the treatment. Your Statement of Applicability must reflect your own decisions about which controls apply and why. An auditor will test whether those decisions are reasoned and traceable to your risk assessment.

Can a partner install and populate the GRC tool for us, and what does that work include?

Yes. An implementation partner can install the tool in your own infrastructure, configure it, load the framework library, and build the risk register, controls, evidence links and audit schedules with your team. Such work usually covers hosting and access setup, integration with identity and ticketing systems, data migration from spreadsheets, and training for control owners. The partner prepares the system and evidence. Your organization still owns the risk decisions, the Statement of Applicability and the controls themselves. Only the certification body issues the certificate. Ask for a written scope that lists deliverables, what your staff must provide, and how handover of the populated tool will work.

Does a GRC tool issue an ISO 27001 certificate?

No. The GRC tool stores your records, but only an accredited certification body can issue an ISO 27001 certificate after an independent audit. ISO itself does not certify organizations. A tool vendor or implementation partner cannot issue or endorse the certificate either. Accredited certification bodies must follow ISO/IEC 17021-1 together with ISO/IEC 27006-1, and the certificate is checked through the accreditation body's database. Before you start, confirm which certification body you will use and ask whether it has any restrictions on tools or consultants that prepared your evidence.

How should we choose between CISO Assistant and eramba?

Start with your licence needs and the features you must run on day one. eramba's risk management module links asset, third-party and business risks to treatments through internal controls, policies, exceptions and projects, and it generates audit records from each control's testing schedule. Its Community edition covers four of seven use cases, while awareness programs, automated account reviews, online assessments, automation, REST APIs and reporting need the paid Enterprise edition. CISO Assistant ships a broad open framework library, including ISO/IEC 27001:2022 with a mapping from the 2013 edition, and a third-party risk module. Because its enterprise directory is under a commercial licence, confirm feature coverage with intuitem. Compare both against a short list of your own workflows before you decide.

Who owns the risk decisions, the tool and the certificate

A self-hosted GRC tool holds the risk register, the Statement of Applicability and audit records, but it does not make decisions for the organization. Four parties hold distinct roles: the organization owns the ISMS, an implementation partner prepares the system, staff run the register, and an independent certification body decides on certification.

The organization owns the ISMS

The organization is accountable for its information security management system, for accepting residual risk and for operating each Annex A control it selects. No tool or consultant can transfer that accountability. Before choosing a platform, confirm which named executive signs the risk acceptance decisions and records them in the tool, and that the Statement of Applicability reflects choices that leadership has actually made.

Implementation partner prepares the system

An implementation partner such as DeployOpen can install, configure, harden, back up and document a self-hosted GRC tool inside the organization's own infrastructure, and help load risks, controls and evidence. The partner does not own the risks, approve treatments or issue audit reports or certificates. Ask for the scope, deliverables and handover documents in writing before work starts.

Staff run the register

Named staff keep the risk register current, record treatment decisions, assign evidence owners and update the Statement of Applicability when controls change. In CISO Assistant, risks link to applied controls, evidence and remediation action plans. In eramba, each internal control carries its own evidence owner and testing schedule. Check that people, not the tool defaults, own these records and that someone is responsible when a review date passes.

Independent certification body certifies

Only an accredited, independent certification body audits the ISMS and issues the ISO/IEC 27001 certificate. ISO does not certify organizations, and neither the tool vendor nor the implementation partner can do so. Confirm the certification body's accreditation before contracting, and check the issued certificate in the IAF CertSearch database, which ISO points to for accredited certificates.

How DeployOpen fits the GRC tool decision

DeployOpen plans, deploys and supports self-hosted open-source platforms inside your own infrastructure, whether that is your cloud accounts, data centers or an air-gapped network. For a GRC tool, that work covers installing the platform, configuring its ISO/IEC 27001:2022 framework library, connecting it to identity, ticketing and logging sources, and setting up the evidence structure so that each applied control, owner and testing schedule can be shown to an assessor. The scope, deliverables and timelines are agreed in writing before any work starts, so you know in advance which items are in the engagement and which remain with your team. No pricing is set until that written scope exists, and a quote follows from it.

The decisions stay with you and with your certification body. Choosing between CISO Assistant and eramba is a licensing and business decision, and it depends on whether you need features such as the paid editions of eramba or a commercial enterprise module from intuitem, and on whether your use of a community license is acceptable under its terms. Your risk owners decide the risk treatments and accept residual risk, and your leadership approves the Statement of Applicability. DeployOpen can prepare the tool, the integrations and the evidence for an assessment, but it does not issue audit reports or certificates. Only an accredited certification body does that. Before you commit, ask the vendor and your intended auditor to confirm which features your use case needs and whether they accept the tool's output as evidence.

How DeployOpen scopes, deploys and hands over a self-hosted GRC tool

DeployOpen plans and implements self-hosted GRC tools inside your own cloud accounts, data centers or air-gapped networks, so the risk register, Statement of Applicability and audit records stay under your control. We agree the scope in writing before work starts, and we prepare the tool and its evidence while your organization keeps ownership of its controls and the certification decision stays with an independent certification body.

How we scope

Written scope names which ISO 27001 risk register, Statement of Applicability and audit workflows the tool will hold.
Scope confirms whether you need CISO Assistant, eramba Community or a paid edition for features such as automation or reporting.
We confirm edition feature coverage with the vendor in writing before the tool choice is fixed in the scope.

How we build

We install the chosen GRC tool in your environment, configure its ISO 27001 framework or internal controls, and set user roles.
We load your asset, risk and control records and link each risk to its treatment, owner and evidence source.
We test that audit schedules, evidence owners and success criteria work as the written scope describes before go-live.

How we hand over

You receive documentation of the deployed configuration, data flows, backup arrangements and access model.
We run a walkthrough with the people who will maintain risk entries, control tests and the Statement of Applicability.
Your team owns the licensed tool, its data and the decisions recorded in it, and we list the open items that remain yours.

How we support

Ongoing support, upgrades and security testing of the GRC platform are available as a retainer after handover.
Upgrades to the GRC tool are planned and tested in a separate environment before they reach production records.
Certification audits remain with your organization and an accredited certification body, and we support evidence requests as scoped.

Self-hosted GRC tools for ISO 27001: CISO Assistant and eramba