A self-hosted Information Security Management System for ISO 27001, NIS2, GDPR/DSGVO and BSI IT-Grundschutz. Built by a CISO, for CISOs.
SMEs and mid-sized companies face an impossible choice when it comes to ISMS tooling.
Commercial ISMS platforms typically cost €5,000–30,000 per year — unaffordable for most organisations.
Excel-based ISMS documentation can't enforce workflows, track policy acknowledgements or produce audit evidence automatically.
Storing sensitive security documentation in a third-party cloud contradicts the very principles of a sound ISMS.
313 controls across 8 frameworks. One platform. Fully self-hosted.
Full document lifecycle — draft, review, approve, archive. Version history, role-based workflows, policy acknowledgements for staff without accounts.
ISO 27001-aligned risk assessment with treatment tracking, CVSS scoring, scanner import from Greenbone/OpenVAS and multi-framework mapping.
313 controls across ISO 27001, NIS2, BSI IT-Grundschutz, EUCS, EU AI Act, ISO 9001, CRA and EUCS — with inline editing and CSV/PDF export.
Processing activity records (VVT), DPIA, 72h incident timer, deletion log (Art. 17), DSAR management and processor agreements.
ISO 27001 A.5.9–5.12 asset classification, criticality levels, supplier audit tracking and BCM/BCP with business impact analysis.
Semantic search via Ollama — runs entirely on your server, no cloud API, no data leaving your infrastructure. 100% GDPR-compliant.
Choose the option that fits your team and infrastructure.
Run it on your own server — full control, no dependencies.
We host and maintain your dedicated ISMS Builder instance.
ISMS Builder is fully open source. The AGPL-3.0 license ensures that any modified version running as a network service must also remain open source — keeping the ecosystem transparent and auditable.
Built by a practising CISO and DPO with 35+ years of IT experience. Every feature exists because it was needed in the real world.
Whether you need help getting started, want to discuss a managed instance
or have a consulting enquiry — reach out directly.
