Athorize

Free, self-hosted compliance operations for teams that answer to more than one framework.

Track controls, evidence, findings and audits across 18 frameworks in one place. The crosswalk links them, so fixing a finding or uploading one piece of evidence shows up everywhere it legitimately counts. Athorize runs on your own server or laptop, and your compliance data never leaves it.

Version 1.0 · free and open source (AGPL-3.0) · Docker, Linux, Windows (beta)

Created by Douglas Cleary.

All data shown is the built-in demo (fictional companies Acme, Northwind and Contoso).

Dashboard: open findings, aging, evidence freshness	Crosswalk: one NIST 800-53 control and everything it also satisfies
Cross-framework impact: one finding, 17 affected frameworks	Compliance Red Team: 10 findings, 3 attack chains, estimated exposure in dollars

More screenshots: evidence with crosswalk suggestions · Inspection Prep readiness · reports and executive briefing · a Red Team finding with its cost breakdown · first-run setup

Why Athorize

• Free and open source. AGPL-3.0, every feature included. No license keys, no trial limits, no paid tier.
• Self-hosted. It runs on your server, VM or laptop. You own the database, the evidence files and the backups.
• Runs offline. Nothing in the running app needs the internet. Framework catalogs and mappings ship as local files, and there is an offline install path for disconnected networks.
• Your data never leaves your server. No cloud component and no telemetry. Live threat feeds are off until you turn them on.
• 18 frameworks, one crosswalk. Controls are linked through NIST SP 800-53, mostly using NIST's own published mappings, so work done once counts everywhere it applies.

Features

• 18 frameworks, 1,077 controls: NIST 800-53 r5, 800-82 r3 (OT), CSF 2.0, CMMC 2.0, FedRAMP, StateRAMP, IRS 1075, CJIS, HIPAA Security, ISO/IEC 27001:2022, PCI DSS v4, IEC 62443, NERC CIP, GDPR, CCPA/CPRA, SOX, GLBA and DORA. Turn on the ones you need; build your own with the Framework Builder.
• Crosswalk ("implement once, comply many"): 3,494 control-to-control links, mostly from NIST's official mappings, routed through 800-53. Each control shows what it also satisfies; a finding shows every framework it affects; a review queue proposes status changes and never applies them silently.
• Compliance Red Team: reviews a system's compliance data the way a hostile assessor would: controls with no or expired evidence, weak narratives, implementation gaps, overdue or unplanned findings, missing assessments and past-due deadlines. Each gap comes with the affected controls (where there are any), remediation guidance and pre-filled finding language (one click files it), and related gaps link into attack chains such as Audit Failure Risk. Every gap carries an estimated dollar range that cites its sources (IBM/Ponemon 2024 breach costs, statutory penalty ranges, your revenue and contract figures); these are planning estimates, and they feed the executive briefing. It tests the compliance program, not the network.
• Evidence, findings and POA&M tracking, with owners, due dates, comments and @mentions, saved views and bulk edits.
• Continuous monitoring: set a cadence per framework, and see what's due and what's stale. The calendar pulls in every deadline: finding due dates, milestones, evidence expiries, assessments and cadences.
• Threat advisories from CISA KEV, NVD, CISA advisories and vendor CSAF feeds, matched to your IT and OT assets and the controls they touch. Live feeds are opt-in; offline installs and the demo use bundled sample advisories about fictional vendors (labelled Sample).
• Imports: 17 finding formats: Splunk, Microsoft Sentinel, CrowdStrike, Elastic, Wazuh, GuardDuty, Suricata, Snort, YARA, CEF, syslog and Windows Event Log, plus Nessus (CSV and native .nessus), Qualys, Tenable and OpenVAS scan results. Asset inventories and POA&M/SSP spreadsheets import too.
• Audit readiness: an Inspection Prep score with punch list and 90/60/30 timeline, per-assessment reports, audit binders, and an executive briefing (PowerPoint) for the whole company or one system and framework: posture, estimated exposure, open findings, crosswalk leverage, program health, a 30/60/90 plan and recommendations, in eight sections (long tables continue onto extra slides).
• Built for real teams: six roles, per-system access, OIDC single sign-on, API tokens, a tamper-evident (hash-chained) audit log, and backup and restore.

Install

Docker (recommended)

You need Docker with the Compose plugin (Docker Desktop on macOS or Windows).

Try the demo (fictional data; log in as admin / admin):

git clone https://github.com/djctwo/athorize.git && cd athorize
docker compose -f docker-compose.demo.yml up -d      # then open http://localhost:8002

Your own instance (blank; opens on the Setup screen):

docker compose up -d                                 # then open http://localhost:8001
docker compose logs athorize | grep "SETUP TOKEN"    # the one-time setup token

This is the beginning of the README. Read the rest at the original. Read the full README ↗