Running an ISMS on European and German frameworks
ISMS Builder is a self-hosted Node.js web app for running an information security management system (ISMS): controlled documents, the Statement of Applicability (SoA), risks, assets, suppliers, business continuity and audit findings. The interface comes in English, German, French and Dutch, and a public demo instance runs on fictitious data that is reset every day.
The frameworks it ships ready to use are European and German: NIS2, BSI IT-Grundschutz, the AI Act, the Cyber Resilience Act and EUCS, with a separate GDPR module. Probo describes itself as open source tooling for SOC 2, GDPR and ISO 27001, while CISO Assistant lists more than 220 bundled frameworks.
The comparison of open source GRC tools sets the frameworks each project ships against the work it leaves to you.
Article-by-article NIS2 deadlines and inherited protection needs
- NIS2 handled article by article: a 30-item checklist for Article 21, and Article 23 deadlines computed for each incident (early warning within 24 hours, notification within 72 hours, final report one month after the notification). The CISO gets an email reminder before each deadline.
- No account needed outside the security team: staff acknowledge a policy through a tokenized link, and incident reports come in through a public form.
- Protection needs that propagate: confidentiality, integrity, availability and authenticity are rated from 1 to 4, and an asset takes on the highest rating of any asset that depends on it, as the BSI maximum principle prescribes.
- Scanner output turned into risks: a Greenbone/OpenVAS report, in XML or PDF, becomes a draft risk.
- Audit log on every create, update, delete and login, plus TOTP two-factor authentication that an admin can enforce for the whole organisation.
Bring your own ISO 27001 controls; one maintainer
ISO 27001 controls are not included. ISO standards are copyrighted, so the ISO 27001, 9000 and 9001 tabs of the SoA ship empty. To use them, the administrator gets a licensed copy of the standard, writes its controls into a JSON file and runs scripts/import-iso-controls.sh. What does ship is 147 controls: 66 for BSI, 30 for the Cyber Resilience Act, 23 for EUCS, 18 for the AI Act and 10 for NIS2. SOC 2 is not an SoA framework at all; it only shows up as a supplier triage criterion.
Built for a small team on a single instance. The README targets an ISMS team of one person, sometimes a handful. One instance can hold several entities of a group, but the project states it is not a multi-tenant hosting product. The login throttling added in v1.40.4 rests on the same assumption: it counts failed attempts in memory and does not share them across instances behind a load balancer.
JSON files remain the recommended storage. SQLite, MariaDB and PostgreSQL are supported, yet .env.example recommends JSON until the SQL migration is finished, and users and roles stay in a JSON file whichever backend you pick.
There is no hosted version and no support contract. Deployment, TLS, backups and updates are the operator's job, and the tool certifies nothing. If you need guaranteed response times, the README itself points you to a commercial vendor. The project publishes no installer or ZIP archive, only source code and, since v1.40.0, a Docker image; the README warns about a fake repository whose download carries malware.
One maintainer, releases in bursts. The public repository dates from March 2026, and its first published release was already numbered 1.29.0; the README calls the project "not yet a finished product". Of seventeen GitHub releases, five came out from March 10 to 13, none until July 27, then twelve up to v1.40.4 on September 3. No commit has reached the main branch since. The project has a single maintainer, who works on it alongside a full-time job, authored 126 of the 146 commits and only patches the latest release. Version 1.40.3 closed a hole that let any logged-in account, read-only ones included, read the SMTP and WebDAV passwords (advisory GHSA-63xg-pg3x-g36f). The changelog and commit messages are mostly in German. Under AGPL-3.0, anyone running a modified version as a network service must publish its source.