Open-source system

CISO Assistant for risk and compliance

Alternative to Vanta and Drata

Risk register, controls, evidence, and compliance assessments for frameworks like ISO 27001, in Arabic.

Available on request: We set it up for you when you ask for it.

Request it + Add to request All systems in Compliance and data protection

System facts

Alternative to
Vanta, Drata, Manual work and spreadsheets
Built on
CISO Assistant (AGPL-3.0-only license)
Hosting
We host it for you in Egypt: Link Datacenter in Egypt or Huawei Cloud, Cairo region
Language
Interface in Arabic
Sign-in
With your company's single sign-on
Ordering
On its own or in a bundle
Status
Available on request
Price
We send it to you after a short call

What it does for you

A single home for your company's information security program: select compliance frameworks like ISO 27001, review their requirements, evaluate your current readiness score, and link each requirement to implemented controls and audit evidence. Alongside it, maintain a structured risk register with impact scoring and treatment roadmaps, so you know where you stand before auditors arrive.

Alternative to

If you are looking for an alternative to Vanta or Drata, this replaces:

  • Vanta.
  • Drata.
  • Excel spreadsheets used to track risk registers and compliance matrices.

What you get

  • Framework library covering ISO 27001, NIST CSF, SOC 2, PCI DSS, GDPR, and other major standards.
  • Compliance assessments evaluating requirement readiness and tracking completion percentage.
  • Cross-framework mapping: Mapping common controls so work evaluated for one standard automatically reflects on others.
  • Control catalog defining organizational and technical safeguards with assigned owners.
  • Audit evidence repository attaching documentation directly to corresponding controls.
  • Risk register evaluating likelihood and impact scores before and after mitigation treatments.
  • Risk treatment plans and formal risk acceptance workflows with executive sign-off.
  • Asset tracking mapping business assets to specific threats and controls.
  • Executive reports prepared for management review and external auditor examination.
  • REST API to integrate compliance metrics into internal systems.

Built on CISO Assistant, an open-source governance, risk, and compliance (GRC) platform.

Arabic and hosting in Egypt

  • Arabic: The interface supports Arabic, and all entered risks, controls, and evidence descriptions work natively in Arabic.
  • Hosting: We host it for you in Egypt, ensuring your sensitive risk registers and audit evidence stay securely within national borders (infrastructure design).

From ready-made to built for you

  1. 01 As-is The platform configured with the standard framework catalog.
  2. 02 Configured for your workflow Target compliance frameworks, asset inventory, team roles, and initial risk register setup.
  3. 03 Customized Custom risk assessment scoring criteria and branded management compliance reporting.
  4. 04 Built for you Automated evidence collection linked to internal systems, or importing custom internal security frameworks.

Customization and building from scratch are part of our software and application development service.

Works with

Part of: Compliance add-on

Who it is for

Frequently asked questions

Is it an alternative to Vanta or Drata?

Yes, for risk registers, compliance gap assessments, control mapping, and evidence management. The difference is open source, native Arabic support, and private hosting inside Egypt.

Does it help me achieve ISO 27001 certification?

It structures your journey: requirements, controls, audit evidence, and risk registers in one place. Formal certification is granted by an independent accredited certification body after an official audit.

Does it support multiple compliance frameworks simultaneously?

Yes, and evaluations completed in one framework automatically map to corresponding requirements in shared standards.

Is the interface available in Arabic?

Yes.

Our limits

  • Certain advanced enterprise modules exist in proprietary editions from the developer; we clarify open-source inclusions before kickoff.
  • We do not issue certification credentials or perform accredited third-party audits; that is the responsibility of certification bodies.
  • The software is from its developer (intuitem); our role is hosting, configuration, operation, and support.

Risk and compliance (GRC): Request it

Request it info@foundationcx.com