🎯 What is ISMS CORE?
ISMS CORE is a production-grade control engineering platform for building and operating an information security management system. It treats compliance implementation as an engineering problem — not a consulting exercise.
New here? Read PARADIGM.md first — it explains how ISMS CORE differs from traditional ISMS approaches, how to choose between products, and what to expect.
Five Products. Four Standards. One Platform.
Full SSE engineering product for mature security teams and consultants. Governance policies, implementation guides, assessment scripts, generated workbooks — one complete pack per control.
53 control packs · 93 Annex A controls
376 IMP docs · 188 generators
EN · FR · DE · IT
Foundation ISMS for SMEs (10–500 people). Operational policies with single-sheet compliance checklists. No engineering overhead — read the policy, run the checklist, done.
53 control groups · 53 OP-POL docs
53 checklist generators
EN · FR · DE · IT
Privacy information management — controller, processor, and shared control groups for ISO 27701:2025. Pairs with Framework or Operational.
21 control groups · 23 PRIV-POL docs
42 IMP docs · 21 generators
EN · FR · DE · IT
PII protection + cloud security controls — checklists for cloud service providers processing PII (ISO 27018:2025 Annex A) plus 4 standalone cloud security extension controls (ISO 27017:2026), each a standalone standard alongside ISO 27001.
16 control groups · 16 POL docs
32 IMP docs · 16 generators
EN · FR · DE · IT
AI management system — governance policies covering AI development, deployment, impact assessment, responsible use, and third-party AI relationships.
10 AI control groups + 2 foundation policies · 12 AI-POL
20 IMP docs · 10 checklist generators
EN · FR · DE · IT
Live compliance management system — turns all content products into dashboards, gap tracking, evidence ingestion, risk registers, and audit reports. Docker Compose, 10 services, self-hosted.
46 connectors · 29 assessment modules · 4,632 crosswalk objects / 60 axes
8 country jurisdictions · 21+ threat intelligence sources
📦 What You Get — Ready to Use
This is not a framework reference or a checklist template library. Every control pack ships production-ready artifacts you open, adapt, and issue.
Example workflow — A.8.24 Use of Cryptography:
- Open
POL/ → your organisation's cryptography policy, ready to sign and issue
- Open
IMP/ → the …-UG file: how to run a key management programme (KPIs, review cycle, ownership)
- Open
IMP/ → the …-TG file: TLS config, certificate lifecycle, HSM setup, vendor notes
- Run
SCR/generate_a824_*.py → produces .xlsx assessment workbook
- Hand the workbook to your auditor as structured compliance evidence
Prerequisites for generators: Python 3.11+, pip install openpyxl
🧭 Who This Is For (and Not For)
This is for:
- Security teams building an ISMS wanting repeatable, auditable evidence
- Engineers who prefer automation + tests over "security theater"
- SMEs needing practical, audit-ready policies without over-engineering
- Organisations processing PII needing ISO 27701 controller/processor controls
- Cloud service providers needing ISO 27018 PII compliance or ISO 27017 cloud security controls
- Organisations developing AI systems needing ISO 42001 AIMS governance
- Consultants and auditors needing structured, traceable control packs
This is not for:
- "One-click compliance" expectations
- Legal interpretations of GDPR/DORA/NIS2 (use counsel)
- Running scripts you haven't reviewed (treat this like code)
🚀 Quick Start
Prerequisites: Python 3.11+, pip install openpyxl
Framework — ISO 27001:2022 Full Engineering
# Browse the 53 control packs
cat isms-core-framework/CONTROLS.md
# Navigate to a control, read POL → IMP-UG → IMP-TG, then generate the workbook
cd isms-core-framework/A.8-technological-controls/isms-a.8.24-use-of-cryptography/SCR
python3 generate_a824_1_data_transmission_assessment.py
Operational — ISO 27001:2022 SME Edition
cd isms-core-operational/A.5-organisational-controls/isms-a.5.1-2-6.1-2-secure-employment-and-roles/SCR
python3 generate_op_checklist_a512612.py
Privacy — ISO 27701:2025
cd isms-core-privacy/privacy-controller/priv-a.1.2.2-5-lawful-basis-and-consent/SCR
python3 generate_priv_checklist_a1225.py
Cloud PII — ISO 27018:2025
cd isms-core-cloud/iso27018-pii-cloud/cld-a.11-information-security/SCR
python3 generate_cld_pii_checklist_a11.py
Cloud Sec — ISO 27017:2026
cd isms-core-cloud/iso27017-sec-cloud/cld-sec-a.5.38-shared-roles-responsibilities/SCR
python3 generate_cld_sec_checklist_a538.py
AI — ISO 42001:2023
# Start with the AI governance foundation policy (available in EN, FR, DE, IT)
cat "isms-core-ai/00-ai-foundation-policies/ai-pol-01-aims-governance-and-decision-making/POL/AI-POL-01 - AIMS Governance and Decision-Making Framework.md"
Platform — Live Compliance Dashboard
cd isms-core-platform
cp .env.example .env # Fill in HOST_IP, passwords, ADMIN_PASSWORD
docker compose up -d # COMPOSE_PROFILES=opensearch-single is set in .env.example
bash bootstrap.sh # One-shot: seeds all control groups, imports all content
# → Open https://{HOST_IP}
Read PLATFORM.md for the full deployment guide, TLS options, connector setup, and Go-Live Checklist.
📸 Platform Screenshots
🔗 Framework Integration
| Framework / Standard | What ISMS CORE provides | Status |
|---|
| ISO/IEC 27001:2022 | Full Annex A control packs (Framework + Operational) | |
| ISO/IEC 27002:2022 | Implementation guidance integrated into IMP-TG documents | |
| ISO/IEC 27701:2025 | Full Privacy Extension Pack — controller, processor, and shared controls | |
| ISO/IEC 27018:2025 | Full Cloud Extension Pack — 12 Annex A control groups for PII in cloud | |
| ISO/IEC 42001:2023 | Full AI Extension Pack — 10 AI control groups (plus 2 foundation policies) covering AIMS governance, impact assessment, responsible use, and third-party AI | |
| NIST CSF 2.0 | Full assessment tool — 106 subcategories, tier 1–4 ratings, XLSX import/export, radar chart. ISO 27001 crosswalk. | |
| NIST AI RMF 1.0 | Full assessment tool — 72 subcategories, 0–4 maturity; ISO 42001 crosswalk: 32 mappings, EU AI Act: 13 mappings | |
| NIS2 Directive (EU 2022/2555) | 10 Article 21 measures + 5 Article 23 obligations, maturity 0–4 | |
| DORA (EU 2022/2554) | 27 articles across 5 pillars (ICT Risk, Incident Reporting, Testing, TPRM, Information Sharing), maturity 0–4 | |
| CIS Critical Security Controls v8 | 153 safeguards across 18 controls, maturity 0–4 | |
| BSI IT-Grundschutz Kompendium | All 111 Bausteine across 10 layers, maturity 0–4. Crosswalk: ISO 27001↔BSI (386), ISO 27701↔BSI (101), ISO 27018↔BSI (51) | |
| CSRM (Swiss NCSC, 2025) | Object-centric module — IT Protection Objects, 20 NIST CSF 2.0 baseline requirements, binary status, 6 Control Objectives | |
| TISAX / VDA ISA 6.0 | 79 requirements across 9 domains, maturity 0–4 | |
| Swiss nDSG 2023 | 25 provisions across 6 chapters, maturity 0–4 | |
| Swiss ISG (SR 128, 2024) | 27 requirements across 8 sections, 24h cyberattack reporting; ISO 27001 crosswalk: 27 mappings | |
| EU Cyber Resilience Act (2024/2847) | 26 essential requirements across 6 groups, maturity 0–4 | |
| EU AI Act (2024/1689) | 9 articles — Chapter III Section 2 high-risk system requirements (Art. 8–15) plus Art. 27 fundamental rights impact assessment, maturity 0–4 |
✈️ Philosophy: Not Cargo Cult
"The first principle is that you must not fool yourself — and you are the easiest person to fool."
— Richard Feynman
| Cargo Cult | ISMS CORE |
|---|
| ❌ | Impressive policies nobody reads | ✅ Controls that actually work |
| ❌ | Made-up compliance numbers | ✅ Evidence that proves effectiveness |
| ❌ | Security theater for audits | ✅ Metrics that measure real security |
| ❌ | PowerPoints instead of controls | ✅ Automation that enforces compliance |
See PHILOSOPHY.md for the full methodology.
🔬 Quality Assurance
Every control pack undergoes a structured multi-stage validation before promotion to this repository:
┌──────────────────┐ ┌───────────────────────┐ ┌──────────────────────┐
│ Claude Code │────▶│ ISMS QA Engine │────▶│ The ISMS Core │
│ (Build + QA) │ │ Existence + Keyword + │ │ Project (Final) │
│ │ │ Semantic 3-layer check │ │ │
└──────────────────┘ └───────────────────────┘ └──────────────────────┘
All 188 Framework generators, 53 Operational policies, 21 Privacy control groups, 16 Cloud control groups (12 PII + 4 Security), and 10 AI control groups carry QA_VERIFIED markers confirming a full QA pass.
See CONTRIBUTING.md for detailed QA standards.
📊 Status at a Glance
| Product | Control groups | Key artifacts | Languages | Version |
|---|
| 🏗️ Framework | 53 / 53 | 376 IMPs · 188 generators · 188 workbooks | EN FR DE IT | |
| ⚡ Operational | 53 / 53 | 53 OP-POL · 53 checklist generators | EN FR DE IT | |
| 🔒 Privacy | 21 / 21 | 23 PRIV-POL · 42 IMPs · 21 generators | EN FR DE IT | |
| ☁️ Cloud | 16 / 16 | 16 CLD-POL · 32 IMPs · 16 generators | EN FR DE IT | |
| 🤖 AI | 12 / 12 | 12 AI-POL · 20 IMPs · 10 generators | EN FR DE IT | |
| 🖥️ Platform | 104 total | 46 connectors · 29 assessments · 4,632 mappings / 60 axes | 8 jurisdictions | |
📂 Repository Structure
See STRUCTURE.md for the complete repository map with per-folder and per-artifact-type explanations.
📚 Documentation
🔒 Security
- Vulnerability reporting: Report security issues to [email protected] (subject: "ISMS CORE Security")
- Safe usage: Review scripts before execution. Run in a virtual environment. Treat generated artifacts as sensitive until proven otherwise.
- No secrets: Do not commit credentials, tokens, private keys, or customer data to this repository or to generated workbooks.
📜 License
Two separate works, two licenses:
- Content packs (
isms-core-framework/, isms-core-operational/, isms-core-privacy/, isms-core-cloud/, isms-core-ai/ — the POL/IMP/SCR compliance documents) are dual-licensed:
- AGPL-3.0 for open-source use — see LICENSE
- Commercial license for organisations that cannot comply with AGPL obligations — [email protected]
isms-core-platform/ (the deployable API/engineering product) is Apache 2.0 — see isms-core-platform/LICENSE. Distributed as pre-built container images; no commercial license needed.
📞 Contact
