Getting started

  1. Sign in at your-name.isoharbor.com with the administrator details we emailed you, then change the temporary password under My profile.
  2. Create a domain (Organisation > Domains) to scope your work. Add perimeters if needed.
  3. Load your standards from Catalog > Libraries. Your plan includes every ISO standard in the library and a set number of other standards. See Your subscription.
  4. Start a compliance assessment for a loaded framework, then assess each requirement and link applied controls and evidence.
  5. Run a risk assessment: choose a risk matrix, add risk scenarios with threats, assets and controls, and track residual risk.
  6. Invite your team under Settings > Users and assign them to groups.

ISO standards in the library

Ready to load from Catalog > Libraries: ISO/IEC 27001:2022 (with its Annex A control list), ISO/IEC 27001:2013, ISO/IEC 27701:2025, ISO/IEC 42001:2023 and ISO 22301:2019, plus the ISO 27005-style 5×5 risk matrix and mappings between ISO/IEC 27001:2022 and NIST CSF, NIST SP 800-53, SOC 2, CIS Controls, NIS2 and others. Other standards (for example ISO 9001, ISO 14001, ISO 45001, ISO 37001, ISO/IEC 27017, 27018 or 20000-1) are not distributed because their text is copyrighted, but you can import your own control set for them as described below.

Import your own framework or controls

You can upload a framework you wrote yourself (for example your ISO 9001 or ISO 14001 controls, or a customer's security requirements) as a YAML file or an Excel workbook. A framework you upload counts as one of the frameworks in your plan unless it is an ISO standard.

  1. Start from an example: example-custom-framework.yaml (simple YAML) or example-framework.xlsx (Excel workbook from the CISO Assistant project; notes in the cells explain each column).
  2. Give the library and framework a unique URN (for example urn:your-company:risk:framework:iso9001-2015) and list your requirements: ref_id, name, description, depth, parent_urn and whether each is assessable. In Excel, keep the sheet structure and fill one row per requirement.
  3. Write requirement text in your own words. Do not paste text from ISO or other copyrighted standards.
  4. In your workspace open Catalog > Libraries, choose Upload library and select the .yaml or .xlsx file. It is stored and loaded in one step; the framework then appears under Catalog > Frameworks.
  5. Create a compliance assessment on it like any other framework. To update it later, upload a new file with the same URN and a higher version.

ISMS policy and audit templates

Every workspace includes ready-made templates written by IsoHarbor (original wording, no copyrighted ISO text) under Documents > Document templates: ISMS scope statement, Statement of Applicability, risk treatment plan, internal audit programme and plan, internal audit checklist, management review minutes, nonconformity and corrective action (CAPA) log, document control procedure, and policies for risk management, business continuity, backup, logging and monitoring, change management, privacy and AI management, alongside the built-in security policies. Create a document from a template, edit it, send it for approval and export it to PDF. You can also download the template pack (Markdown) and re-import it under Document templates > Import. For a complete SoA, run a compliance assessment on ISO/IEC 27001:2022 and use its Statement of Applicability export.

Multi-factor authentication

New workspaces require every user to set up an authenticator app (TOTP) or security key at their next sign-in. Administrators can change this under Settings > General > Enforce multi-factor authentication. It is enforced by the API as well as the web app. Users who sign in through SSO follow your identity provider's MFA policy.

Billing

Open Customer account and sign in with the subscription email to see your plan and invoices, update your card or cancel. If a payment fails or the subscription ends, the workspace becomes read-only for a grace period and is then suspended. Your data is kept.

AI assistance

Use the AI Assistance button on any screen, the help chat bubble, AI risk analysis on a risk scenario, or Generate policy with AI under Policies. AI output can be wrong, so review it before use.

Need help?

Email support@isoharbor.com.

The upstream CISO Assistant documentation also applies: intuitem.gitbook.io/ciso-assistant.