Introduction
An ISMS for the EU NIS 2 Directive, licensed for self-hosting, and what it does not do.
open-isms is the platform behind nisd2.eu. It is an information security management system: the place where an organisation records what it must do under the NIS 2 Directive, who owns each of those duties, when they are due, and what proves they were done.
Most compliance tooling treats evidence as a folder of PDFs you assemble the week before an audit. open-isms inverts that. Every requirement carries an owner, a deadline and a sign-off, so the assignments, the approvals and an append-only audit log become the evidence as you operate, rather than something reconstructed afterwards.
What is in the box#
Five regulatory frameworks ship as data, not as a marketing claim. The counts below come from @nisd2/grc-data-model and are asserted by a CI check on every push.
| Framework | Categories | Requirements |
|---|---|---|
| NIS 2 (Directive (EU) 2022/2555) | 12 | 49 |
| GDPR | 6 | 9 |
| EU AI Act | 10 | 24 |
| Cyber Resilience Act | 10 | 21 |
| ISO/IEC 27001:2022 | 5 | 116 |
That is 219 requirements, plus 125 cross-framework satisfaction pairs: places where evidence for one requirement genuinely answers another, each carrying the sentence that explains why. An ISO 27001 Clause 5.1 resourcing decision and the NIS 2 budget sign-off are the same act recorded twice, and the platform says so instead of asking you twice.
Around that data sits the operational half: asset inventory, risk assessment, supplier questionnaires and a supplier portal, incident records in the Article 23 notification format, policies, internal audits, management reviews, training with certificates, and the audit log underneath all of it.
What it is not#
- Not a monitoring or detection product. It records and evidences your management system. It does not watch your network, collect logs or raise alerts.
- Not legal advice, and not a certification. Article numbers and national transposition references are cited so you can check them. Whether a given measure is proportionate for your organisation is a decision you make and sign off.
- Not a hosted-only product. The image and the source are available to licensees, and a self-hosted instance has no licence key, no entitlement check and nothing phoning home.
Two ways to run it#
The hosted instance at nisd2.eu is the same software, operated for you. Self-hosting is the path when documents cannot leave your own infrastructure, which for public bodies, welfare organisations and many Mittelstand operators is a condition rather than a preference. These docs are written for the second case.
How these docs are organised#
Getting started is orientation and a ten-minute install. Self-hosting is everything needed to run an instance in production, one topic per page. Platform explains what the software models. Packages covers the schemas published on npm for use without the platform. Contributing is for working on open-isms itself.
Everything here is English only. The rest of the site is translated into ten languages because it is read by the people who must comply; these pages are read by whoever installs the software, and ten machine translations of a docker compose walkthrough would be ten more things to keep true.
Licence#
The application, its scripts and the workspace packages are licensed under the nisd2 self-host licence. A licensee receives read access to the repository, the container image, every update for as long as we maintain the software, written support, and the right to read and adapt the code for their own operation, for any number of organisations and users, for a one-time fee. Applying updates is the licensee's job; nothing updates an install from outside. The price and the licence summary are on nisd2.eu/self-host; the full text is in the repository's LICENSE. To get the repository, the image or a quote, write to contact@nisd2.eu and name the GitHub account that should have access; the image on ghcr.io is private and is pulled with that account (Registry access). If the fee is out of reach for your organisation, say so in the same mail: licences are also granted free of charge, at our discretion.
Versions up to and including v0.2.12 were published under AGPL-3.0-or-later and remain so, including the image tags on ghcr.io/nisd2/open-isms up to that version.
The published packages are open: @nisd2/grc-data-model is MIT (content CC BY 4.0), and @nisd2/incident-notification-schema and @nisd2/nis2-supply-chain-questionnaire-schema are MIT for code and CC BY 4.0 for content. See npm packages.