Documentation
open-isms
A self-hostable information security management system built for the EU NIS 2 Directive, with GDPR, the EU AI Act, the CRA and ISO 27001 alongside it. Free software under AGPL-3.0, published as a container image, with no licence key and nothing phoning home.
Quickstart
One command. It installs, starts and loads the framework data for you.
Self-hosting
Put it on a server: profiles, TLS, storage, backups, updates.
Use the schemas
219 requirements and the incident notification format, on npm, without the platform.
Contribute
Run it locally, understand the layout, and ship a change.
Getting started
What open-isms is, and how to get an instance running.
Self-hosting
Running your own instance in production.
- RequirementsHardware, architectures, Postgres versions, and what you do not need.
- InstallationThe full walkthrough, including the optional compose profiles.
- Synology NASThe path most Mittelstand operators actually take, with or without a terminal.
- ConfigurationEvery environment variable, what breaks without it, and which two are mandatory.
- Framework dataSeeding NIS 2 and ISO 27001. Migrations create the tables; they do not fill them.
- Evidence storageBundled MinIO or your own S3, and why there are two endpoint variables.
- EmailNobody completes a first login without a mail route. The two ways to provide one.
- Domains and TLSThe Caddy profile, the AUTH_URL trap, and when to turn on HSTS.
- Scheduled jobsTwo cron endpoints for deadline reminders, escalation and GDPR retention.
- UpdatingVersion tags, the update command, rollback, and the optional updater container.
- Backup and restoreOne encrypted archive holding both stores, and a restore procedure that has been run.
- TroubleshootingSymptoms, causes, and the commands that tell them apart.
Platform
What the software models, and how compliance evidence is recorded.
Packages
The schemas published on their own, for use without the platform.
Contributing
Working on open-isms itself.
- Local developmentClone, install, database, and the dev server on port 3026.
- Project structureWhere the app ends and the workspace packages begin.
- MigrationsThree chains, forward-only, and the rules that keep other people's databases safe.
- TestingUnit tests, end-to-end tests, and the checks CI runs on every push.
- ReleasesWhat a tag triggers, and the gate a release passes before stable moves.
- SecurityReporting a vulnerability, and the controls that are actually in place.