• CISO Assistant's community edition is free under the AGPLv3 licence, with unlimited users. The licence asks anyone who modifies the software and offers it over a network to publish those changes^[15].
• Its framework list includes NIS2 sets for the Netherlands, Hungary and Lithuania; Vardion carries Greece's KYA 1689/2025 and both instruments of Greece's National Cybersecurity Authority (ΕΑΚ).

CISO Assistant: community edition free; Pro SaaS €39 per contributor a month billed annually; Pro on-premises from €2,400 a year^[1]. Vardion: from €290 a month, billed yearly (pricing).

Side by side

Choose CISO Assistant if

• You want free, self-hosted GRC and have someone to install and maintain it.
• You work across many frameworks and countries and want a large library and 27 interface languages.
• Publishing your own changes under the AGPLv3 suits you.

Choose Vardion if

• You need Greece's KYA 1689/2025 and the ΕΑΚ's gap analysis and self-assessment ready to run, in the authority's own Greek.
• You want scan evidence of what you expose beside your answers.
• You are a consultancy and want client workspaces in your own brand.

Scored comparison

2: the product's own pages state it. 1: in part, or sold separately. 0: not offered.

Which one to choose

If you have a developer, want free software and can add Greece's frameworks yourself, CISO Assistant is a fine choice.

If you want the Greek frameworks maintained for you, scan evidence beside them and workspaces for your clients in your brand, choose Vardion.

Sources

1. intuitem, CISO Assistant pricing
2. intuitem, CISO Assistant
3. intuitem, Frameworks
4. intuitem, home page
5. The ΕΑΚ gap analysis (169 controls in 24 sections) and self-assessment (234 questions), in the authority's own Greek and its file formats
6. KYA 1689/2025 article by article, with policy drafts in English and Greek
7. Finds what the company exposes to the internet and ranks it by what attackers exploit
8. Takes in Tenable, Qualys and Defender results by API and Nessus, OpenVAS and Burp files
9. On Vardion's hosted console for the programme, email and DNS checks and imported results; on your own Linux server with Docker for all of it, scans included
10. Console, reports and policy drafts in Greek and English
11. A supplier register with a grade from public records for each supplier, weekly for the critical ones, with questionnaires you send them
12. A scope check that says whether NIS2 applies
13. Incidents recorded with the significance assessment, the drafted reports and every reporting deadline
14. Client workspaces and your own brand for consultancies
15. GNU Affero General Public License, version 3

CISO Assistant and other product names are trademarks of their owners. This page compares public information and is not endorsed by them.