Self-hosted GRC tools for NIST CSF: CISO Assistant vs eramba

Should a NIST CSF assessment run in self-hosted GRC software instead of spreadsheets?

Often, yes, once the assessment has more moving parts than a spreadsheet can track reliably. Start by holding two facts in view: NIST does not certify or endorse any CSF product, implementation or service, so no tool can make an organization "CSF compliant", and the GRC software only organizes the assessment and its evidence. The organization still owns its controls and decides its Target Profile, and only an independent assessor issues any report. A customer or regulator asking for NIST CSF 2.0 alignment is asking to see that ownership and evidence, not a badge from the software vendor.

The right choice depends on how much the program needs to carry. Count the frameworks you must map at once (CSF alongside ISO 27001, SOC 2 or a sector regulation), the people who must update their own items, the approval workflows for risk acceptance and action plans, and the integrations you need with identity, ticketing or scanning systems. Check the license before you commit. CISO Assistant is AGPL-3.0-only for files outside its top-level enterprise directory, while files inside that directory fall under a proprietary intuitem license that requires a contract. eramba Community is not open source and its license forbids modifying, selling or redistributing the software, and it omits several features that a multi-user program often needs.

If the assessment is a single-team exercise with a few hundred evidence items, NIST's free Organizational Profile template or the CISA and Idaho National Laboratory Cyber Security Evaluation Tool (CSET) may be enough, and the Organizational Profiles Quick-Start Guide (SP 1301) explains how to use the template. Ask your implementation partner and your legal team to confirm the license terms for your intended use in writing before you migrate evidence. Those costs are one-time setup and recurring hosting, maintenance and licensing, so request a written scope that shows both.

What CISO Assistant and eramba Community each cover

Both products keep NIST CSF work in one system of record instead of spreadsheets, but they differ sharply in framework coverage, licensing and which features sit behind a paid edition. The cards below compare them point by point so you can check each claim against the current release before choosing one.

Framework library

CISO Assistant ships more than 200 frameworks, and NIST CSF is among them, alongside ISO 27001, SOC 2, PCI DSS, NIS2, DORA and GDPR. Confirm in the current release whether the NIST CSF library reflects CSF 2.0 Functions, Categories and Subcategories or an older version, and check whether you need to load updated content yourself. eramba's framework coverage should be confirmed separately for your edition.

Risk register and treatment links

eramba's risk management module records asset, third-party and business risks and links each one to its treatment through internal controls, policies, exceptions or projects. This matters for CSF Govern and Identify work, where each risk should trace to a decision. CISO Assistant also keeps risk assessments and risk registers. Test both by tracing one risk from identification to a remediation action before committing.

Applied controls and evidence

CISO Assistant records applied controls, evidence and action plans for remediation in one place, so a CSF Subcategory can point to the control and the artifact that shows it operates. Ask whether evidence can be attached and versioned, and whether it can be reviewed on a schedule. In eramba, control records connect to policies and exceptions, so confirm how evidence is captured for each internal control in your edition.

Third-party risk

CISO Assistant includes a third-party risk module, which supports the CSF Govern supply chain outcomes such as supplier assessment and monitoring. eramba records third-party risks as a distinct risk type and links them to treatments. Confirm whether questionnaires, supplier scoring and contract records are included in your edition, because those features determine how much supplier work moves out of spreadsheets.

Use cases in the Community edition

eramba Community covers 4 of its 7 use cases. Awareness Programs, Automated Account Reviews and Online Assessments need the paid Enterprise edition. If your CSF program depends on training tracking or periodic access reviews, plan for Enterprise from the start and request a written quote covering the modules you need. Confirm the current use case list with eramba before you decide.

Automation, APIs and license terms

eramba's automation, REST APIs, reporting and notifications also require Enterprise. Community is free to use under eramba's own license, which forbids modifying, selling, licensing or distributing the software, so it is not open source. CISO Assistant's community code is AGPL-3.0-only, but files inside its top-level enterprise directory fall under a commercial license from intuitem. Confirm which directories your deployment includes and read the license file before you customize.

Why the license decides what you can deploy

CISO Assistant is an open core product. Most of the repository is licensed under the GNU Affero General Public License v3.0 only (AGPL-3.0-only), which gives you the right to run, study, modify and share the code under that license's terms. The top-level enterprise directory is different. Files inside it fall under the proprietary intuitem Commercial Software License, so the enterprise features that sit there need a contract with intuitem before you can use them. The split is defined at file level, which means the boundary you care about is the directory structure, not the product name.

Open core scope: AGPL-3.0-only applies to files outside the top-level enterprise directory.
Proprietary scope: Files inside the enterprise directory are governed by the intuitem Commercial Software License.
Contract requirement: Using enterprise features requires an agreement with intuitem, which should set terms for use, support and fees.
AGPL obligations: If you modify and offer the AGPL portion over a network, the license's source availability terms apply to you.
Module check: Map each feature you plan to use to its code location before deciding what needs a commercial contract.

Ask counsel to read the LICENSE file in the repository and confirm which directories your planned features depend on.

Which option fits which NIST CSF program

This table compares the NIST Organizational Profile template, CSET, CISO Assistant, eramba Community and eramba Enterprise for running NIST CSF 2.0 work. Read each row for the best fit, the license constraint, the CSF evidence it helps produce and what it leaves to your own governance process.

Option	Best fit and license constraint	What it does for CSF evidence and what it does not do
NIST Organizational Profile template (SP 1301)	Best fit: a small team that needs a side-by-side Current and Target Profile comparison in a spreadsheet. Free NIST template.	Records Current and Target Profile outcomes and gaps. Does not store evidence, track remediation or produce reports on its own.
CSET	Best fit: a guided self-assessment of environment and standards mapping. Free CISA and INL tool. Standalone installers require Windows 10 or later.	Walks users through describing their environment and recommends improvements. Does not manage ongoing risk registers, evidence or CSF Tier decisions over time.
CISO Assistant	Best fit: a self-hosted platform for CSF audits, risk and evidence across many frameworks. AGPL-3.0-only for the community code; the enterprise directory uses a commercial license.	Covers risk assessments, applied controls, evidence, remediation plans and third-party risk, with automatic mapping between frameworks. Does not replace leadership decisions on Tiers or confirm the mapping for your scope.
eramba Community	Best fit: a free trial of risk and control management with limited use cases. Not open source; its license forbids modifying, selling or redistributing the software.	Covers 4 of 7 use cases and links risks to treatments through controls, policies and projects. Does not include Awareness Programs, Automated Account Reviews, Online Assessments, REST APIs or automation.
eramba Enterprise	Best fit: organizations that need the full use case set, automation and REST APIs under a paid commercial license. Confirm current terms with eramba.	Adds awareness, account review, online assessment, automation, reporting and notifications to the risk and control records. Does not establish CSF outcomes or assessment results without your own process and evidence.

When NIST's free Profile template or CSET is enough

NIST's free CSF Organizational Profile template is enough when one small team needs a single, one-time gap analysis between a Current Profile and a Target Profile. The template is an Excel spreadsheet that lets you record both profiles side by side, and NIST explains its use in the Organizational Profiles Quick-Start Guide, SP 1301 (February 2024). Its strength is simplicity: no licence, no installation, and no platform to host. Before you rely on it, confirm with your own team that the people filling it in agree on what each Subcategory means for your environment, because the spreadsheet records answers but does not check them.

CSET, the Cyber Security Evaluation Tool developed by CISA and Idaho National Laboratory, is the better choice when you want a guided walk-through rather than a blank grid. It asks you to describe your environment, compares that description with security standards and regulations, and recommends improvements. Standalone installers require Windows 10 or later, so confirm that your assessment workstation meets this before planning the work. CSET is a sound starting point for a first self-assessment, but it is not a system of record for the evidence an auditor or customer will later request.

Spreadsheets tend to break down at four points: recurring evidence collection, ownership and due dates for action plans, mapping one control set to several frameworks, and audit trails. A one-time profile comparison can survive these gaps, but an annual review cannot. Ask yourself who owns each remediation item, when its evidence was last refreshed, and whether a change to one control is reflected in every framework that cites it. If the answer to any of these depends on someone remembering, it is time to evaluate GRC software such as CISO Assistant or eramba, and to check licence terms before you commit.

How to set up a CSF assessment in a GRC tool

This sequence moves a CSF 2.0 assessment from a defined scope to a set of action plans and evidence packs that an independent reviewer can test. Each phase produces a named output, so the team knows what to hand to the next phase. The time each phase takes depends on scope, number of systems and how much evidence already exists.

Define scope and the Organizational Profiles
The CISO or risk owner decides which business units, systems, data and suppliers fall inside the assessment, then writes the Current Profile and the Target Profile. NIST's Organizational Profiles Quick-Start Guide (SP 1301) explains how the two Profiles are built and compared. The output is a short scope statement and two draft Profiles, both signed off by the accountable executive. The step is done when every Subcategory in scope has either a Current or Target position recorded, even if the position is provisional.
Load or confirm the CSF 2.0 framework content
The GRC administrator confirms that the framework library in the tool holds the CSF 2.0 Core, with six Functions, 22 Categories and 106 Subcategories, and not the superseded CSF 1.1 structure. For CISO Assistant, check the framework load and version against the NIST source before relying on it. For eramba, confirm the framework content available in your edition, since Community may not cover every import path. The output is a written record of which framework version and which informative references are loaded. Confirm the count of Subcategories in the tool matches the count NIST publishes.
Map existing controls and evidence to Subcategories
Security and compliance staff link the organization's existing controls, policies and evidence items to the CSF Subcategories they support. Where a control already satisfies several frameworks, use the tool's own mapping features rather than copying links by hand, and check each automatic mapping before accepting it, because mappings between frameworks are not equivalence. The output is a control register where each applied control points to its Subcategories and to at least one evidence item with an owner and a date. The step is done when no in-scope Subcategory is left without a candidate control or an explicit note that none exists.
Run the gap assessment against the Target Profile
Assessors score each in-scope Subcategory by comparing the evidence against the stated Current position and the Target Profile. The team records where the program falls short, using the Tier language from NIST SP 1302 only as a reference for maturity, not as a certification score. The output is a gap list that names each Subcategory, the current state, the target state and the reason for the difference. Review the scores with a second person, since a single assessor's view tends to inflate ratings on controls they own.
Create action plans with named owners
For each material gap, the risk or compliance owner opens an action plan in the tool, links it to the affected Subcategories and the risk it addresses, and assigns a named owner and a target date. Engineering and platform owners usually take the technical items, while governance items such as policy approval stay with the executive sponsor. The output is a remediation plan that the leadership team has reviewed, with each plan showing its owner and status. The step is done when every high-priority gap has an accepted plan or a documented risk acceptance signed by someone with authority to accept it.
Prepare evidence packs for independent review
The compliance lead assembles, for each in-scope area, the evidence an independent assessor would ask to see: the control description, the configuration or log output, the date it was produced and the person who approved it. Store the packs in the tool's evidence module or a controlled repository that the tool references. The output is an evidence index that matches the control register, with no broken links and no evidence older than the review period the organization has set. Confirm with the chosen assessor which evidence formats they accept before the pack is finalized, since NIST does not certify assessments and the assessor sets the testing approach.

What has to be true before the tool is worth deploying

A GRC platform only produces a credible NIST CSF assessment when the organization has already decided who owns the framework, what it is measuring against, and what the tool will point at. The cards below are checks to clear before installation, not configuration steps, and each one is owned by the organization even when an implementation partner prepares the system.

Named owner for CSF governance

Someone with authority over cybersecurity strategy must be named as the accountable owner of the CSF program, because the Govern Function is about decisions, not records. This person approves the scope of each assessment, signs off on the Target Profile and decides which findings are accepted as risk. Confirm the owner in writing before the platform is configured, and confirm who can change framework mappings, control statuses and risk acceptances inside the tool.

Agreed Current and Target Profiles

Decide what the Current Profile describes and what the Target Profile should reach before importing any framework content. NIST's Organizational Profiles Quick-Start Guide (SP 1301) explains how the two profiles are compared side by side. Without agreed profiles, the platform will hold data but no gap analysis that leadership can act on.

Asset and system inventory

The GRC tool can record assets and link risks and controls to them, but it cannot discover them. Before go-live, the organization should have an inventory of systems, applications, data stores and suppliers that the risk register and control records will reference. Check whether the inventory lives in a CMDB or spreadsheet, who keeps it current, and how often it is reconciled against the real environment.

Evidence sources identified

Each control the platform tracks needs a named place where its evidence actually lives, such as an identity provider export, a vulnerability scanner report or a change ticket. List those sources and their owners before setup, and decide whether evidence is uploaded manually or pulled through an integration. Confirm which connectors each tool supports in your version, since manual attachment is the default assumption for most teams.

License review by counsel

The two tools carry different licenses, and the terms affect what you may do with them. CISO Assistant's core is AGPL-3.0-only, but files inside its top-level enterprise directory fall under a proprietary commercial license that needs a contract with intuitem. eramba Community's license forbids modifying, selling or distributing the software. Ask counsel to read the license text for the exact edition you plan to run, including any use by third parties such as an assessor or a managed service provider.

Hosting and access control for the GRC platform

The GRC platform will hold risk registers, control evidence and possibly vulnerability and audit details, so it is a sensitive system in its own right. Decide where it is hosted inside your environment, who administers it, how its accounts are federated and protected with MFA, and how its database and attachments are backed up. Treat the platform as in scope for the same controls it helps you evidence.

Who owns the tool, the controls and the evidence

Your organization owns the CSF assessment itself. The platform records what you decide, but it cannot make those decisions for you. Your team chooses the Target Profile, judges whether each Subcategory is met, accepts residual risk and signs off on policies. Those choices belong to named people, and an assessor will ask who made them and when.

Risk decisions: Setting risk appetite, accepting or treating risks and approving exceptions stays with accountable managers, recorded in the risk register.
Profiles and scoring: Current and Target Profile content, Tier selection and the rationale for each rating come from your staff, not from default templates in the tool.
Control ownership: Each applied control needs an owner who maintains its configuration, its procedure and its evidence over time.
Assessment content: Framework mappings loaded into CISO Assistant or eramba should be reviewed against your own environment before anyone relies on them.
Operating the evidence: Your staff keep evidence current after go-live, since a platform cannot confirm that a control still operates.

Before signing any engagement, confirm which of these items your team will staff and for how long.

Questions buyers ask about GRC tools for NIST CSF

Is NIST CSF certifiable?

No. NIST CSF 2.0 is a voluntary framework, and NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and has no plans to develop a conformity assessment program. Organizations can measure their program against the CSF, and some customers or suppliers may ask for evidence of alignment, but no body issues a CSF certificate. A GRC tool can store the assessment and evidence. Any formal attestation for a related standard, such as ISO/IEC 27001, must come from an accredited certification body or independent auditor. Confirm with your customer or regulator exactly what proof of alignment they accept before you choose a tool.

Can we use CISO Assistant without paying?

The community edition of CISO Assistant is licensed under AGPL-3.0-only, so you can read, run and modify the code under those terms. The platform ships more than 200 frameworks, including NIST CSF, and covers risk registers, applied controls, evidence, remediation action plans and third-party risk. Check the license boundary before you adopt it. The project is an open core: files inside the top-level enterprise directory fall under the proprietary intuitem Commercial Software License and need a contract with intuitem. Your costs are then the infrastructure to host it, the staff who run and maintain it, and any enterprise features you need. Ask the vendor and your counsel which modules you would use and under which license.

What does eramba Community lack?

eramba Community lacks several capabilities that the Enterprise edition provides. Community covers 4 of 7 use cases, while Awareness Programs, Automated Account Reviews and Online Assessments, plus automation, REST APIs, reporting and notifications, require the paid Enterprise edition. The license is also more restrictive than the name suggests. Since a June 2024 update, eramba's own license forbids modifying, selling, licensing or otherwise distributing the software, and eramba staff state that it should not be called open source. If you plan to integrate the tool with other systems through an API, or to automate evidence collection, confirm the edition and the license terms before you commit, because the missing features are the ones that reduce manual work.

Can the Excel template be enough?

For a small or first-time assessment, NIST's Organizational Profile template can be enough. NIST provides it as an Excel spreadsheet for side-by-side comparison of Current and Target Profiles, and its use is explained in the Organizational Profiles Quick-Start Guide, SP 1301, published in February 2024. The spreadsheet works well for scoping and gap discussions. It becomes hard to manage when you need linked evidence, owners, due dates, version history, risk treatment and reporting to leadership. A GRC tool adds those workflows, while the template remains a clear starting point. CISA and Idaho National Laboratory's free Cyber Security Evaluation Tool (CSET) is another no-cost option, although its standalone installers require Windows 10 or later.

Does a GRC tool replace an assessor?

No. A GRC tool records your controls, evidence, risks and action plans, but it does not decide whether your program meets a framework. Your organization owns its controls and its risk decisions. Where an independent assessment is required, an auditor or assessor reviews the evidence and issues the report. Implementation partners can configure the tool, load the framework content, prepare evidence and document the process, but they do not issue audit reports or certifications. Ask any partner to state in writing which parts of the assessment they prepare and which parts an independent party performs. A tool that maps frameworks automatically still needs human review of each mapping before anyone relies on it.

What does the work need from our team?

The work needs named owners from your own team, because the tool cannot assign accountability for controls. Expect the following roles to take part:

A business owner for governance decisions, risk appetite and sign-off on the Target Profile.
Control owners in IT, security and operations who provide evidence and maintain it over time.
An administrator who hosts, upgrades, backs up and secures the platform inside your own infrastructure.
A compliance lead who keeps the assessment, scope and evidence aligned with what your customers or regulators require.

Effort depends on the number of systems in scope, how much evidence already exists, and whether you use a fixed-scope implementation. Ask for the effort split between configuration, content, integration and training in any quote.

How DeployOpen scopes and prepares a self-hosted GRC deployment

DeployOpen is a Chainscore Labs company that plans, implements, customizes, hardens, backs up and documents self-hosted open-source platforms inside the client's own infrastructure. For NIST CSF 2.0 governance, we prepare the GRC platform, its framework content and its evidence so your team can run assessments in one system, while your organization keeps ownership of its controls and the independent assessor issues any report.

How we scope

Engagements are fixed-scope, with the platform choice, hosting environment and CSF Functions in scope agreed in writing first.
We confirm whether CISO Assistant or eramba Community fits your needs, including the license limits that apply to your use.
The written scope lists which Profiles, assessments, risk registers and third-party modules will be configured for your team.

How we build

We deploy the GRC software inside your own cloud account, data center or air-gapped network, under your access controls.
We load the CSF 2.0 framework content and map your applied controls and evidence fields to the Subcategories you select.
We test user roles, evidence workflows and reporting against the scope before anything is handed to your compliance team.

How we hand over

You receive configuration documentation, an evidence collection guide and a record of the settings applied to each component.
We walk your assessment owners through the workflow so they can update Current and Target Profiles without outside help.
Your organization decides what the assessment says. We do not issue audit reports, attestations or certifications.

How we support

Ongoing support, upgrades and backups can be covered by a retainer agreed in writing.
Upgrades to the GRC platform are tested in a separate environment before they reach production records.
Questions about which Subcategory a piece of evidence supports are answered with reference to the written scope and NIST's published materials.

Self-hosted GRC tools for NIST CSF: CISO Assistant and eramba