> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/configuration/libraries.md).

# Libraries

Understand libraries and choose the right path to create, import, test, and maintain them

Libraries package reusable governance content for CISO Assistant. A library can contain a framework, a threat catalogue, reference controls, a risk matrix, mappings, and many other object types.

{% hint style="info" %}
**New to libraries?** Explore the [Library objects](/ciso-assistant/configuration/libraries/library-objects.md), then create your first library directly in CISO Assistant with the [Library builder](/ciso-assistant/configuration/authoring/library-builder.md). You can also follow [Create a Library](/ciso-assistant/configuration/libraries/create-library.md) if you prefer working with a spreadsheet.
{% endhint %}

## What is a library?

A library is a portable package of objects. It gives those objects a stable identity, a version, and a format that CISO Assistant can import.

One library may contain only one object, such as an internal framework. It can also bundle several related objects, such as a framework together with its reference controls and threats.

You can create a library directly in the [Library builder](/ciso-assistant/configuration/authoring/library-builder.md). The library is stored on the CISO Assistant instance where you create it. Outside the instance, libraries use two file formats: **Excel** *(.xlsx)* and **YAML** *(.yaml)*. Excel is the human-editable source format. YAML is the format CISO Assistant reads. When you import an Excel workbook through the Library catalog, CISO Assistant converts it to YAML automatically.

You normally do not edit YAML directly, including when updating a library. Instead, update the Excel workbook or edit the library in the Library builder.

## What can a library contain?

The following pages describe each object separately. Not every object is needed for every library.

| Element                                                                                                   | What it is for                                                                                                            |
| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| [Library metadata](/ciso-assistant/configuration/libraries/library-objects/library-metadata.md)           | Required properties that identify and describe the library itself.                                                        |
| [Framework](/ciso-assistant/configuration/libraries/library-objects/framework.md)                         | A tree of sections and requirements used to run audits.                                                                   |
| [Implementation groups](/ciso-assistant/configuration/libraries/library-objects/implementation-groups.md) | Optional groups that select a relevant subset of framework requirements.                                                  |
| [Answers](/ciso-assistant/configuration/libraries/library-objects/answers.md)                             | Reusable answer sets used by questions defined in framework requirements.                                                 |
| [Scores](/ciso-assistant/configuration/libraries/library-objects/scores.md)                               | The labels and meanings associated with a scoring scale.                                                                  |
| [Threats](/ciso-assistant/configuration/libraries/library-objects/threats.md)                             | A reusable catalogue of events or situations that can cause harm.                                                         |
| [Reference controls](/ciso-assistant/configuration/libraries/library-objects/reference-controls.md)       | Reusable control templates that can support requirements or mitigate threats.                                             |
| [URN prefixes](/ciso-assistant/configuration/libraries/library-objects/urn-prefixes.md)                   | Technical prefixes used when you need to link external/internal threats/reference controls to requirements of a framework |
| [Risk matrices](/ciso-assistant/configuration/libraries/library-objects/risk-matrices.md)                 | The probability, impact, and risk-level model used in risk assessments.                                                   |
| [Mappings](/ciso-assistant/configuration/libraries/library-objects/mappings.md)                           | Links between the requirements of two frameworks.                                                                         |

Every Excel version of a library must include a `library_meta` sheet, which defines the properties of the library as a whole. See [Library metadata](/ciso-assistant/configuration/libraries/library-objects/library-metadata.md) for more details.

For an overview of how these elements relate to one another, see [Library objects](/ciso-assistant/configuration/libraries/library-objects.md).

## Why use libraries?

Libraries keep content reusable and consistent. Instead of rebuilding the same framework for every audit or project, you can import it once and use it wherever it is needed.

They also make change manageable. A library version records the content that was published, while stable identifiers let CISO Assistant recognise the same objects when you publish a later version.

## How an Excel library is organized?

When a library is stored as an Excel file, the workbook itself is the library. Imagine it as a large box. The `library_meta` sheet is the label on that box: it gives the library its name, identifier, version, and other properties.

Each `_content` sheet is a smaller box inside the workbook: it holds the entries of one object. Its matching `_meta` sheet is the label on that box, telling CISO Assistant what the object is. For example, if we use `fwk` as the sheet prefix, `fwk_content` is the box holding the Framework's sections and requirements, while `fwk_meta` is its label. The shared `fwk` prefix shows that the two sheets belong together.

`library_meta` is special. It describes the entire library, so it does not need a matching `library_content` sheet.

## Choose your path

Not sure where to start? Use the table below to find the page that matches your goal.

| If you want to...                              | Start here                                                                                               |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Create your first framework from an Excel file | [Create a Library](/ciso-assistant/configuration/libraries/create-library.md)                            |
| Follow a complete small example                | [Guided example: create your first framework](/ciso-assistant/configuration/libraries/guided-example.md) |
| Browse the available sample workbooks          | [Examples](/ciso-assistant/configuration/libraries/examples.md)                                          |
| Import a finished library into CISO Assistant  | [Import a library](/ciso-assistant/configuration/libraries/import-library.md)                            |
| Publish a new version of a custom library      | [Update a library](/ciso-assistant/configuration/libraries/update-library.md)                            |
| Handle a standard with its own import workflow | [Special cases](/ciso-assistant/configuration/libraries/special-cases.md)                                |

## Related concepts

* [Libraries concept](/ciso-assistant/concepts/catalog/libraries.md)
* [Frameworks concept](/ciso-assistant/concepts/catalog/frameworks.md)
* [Vocabulary](/ciso-assistant/introduction/vocabulary.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://intuitem.gitbook.io/ciso-assistant/configuration/libraries.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.