ISMS CORE Repository Structure

πŸ“‚ Repository Structure

Complete map of all folders, files, and artifact types in this repository.

--- ## Artifact Types β€” What's Inside Each Control Pack Before reading the folder tree, understand what each artifact type is: | Artifact | Format | What it is | Who uses it | |----------|--------|------------|-------------| | **POL** | Markdown | Governance policy β€” what the control requires, who owns it, applicable standards. Ready to sign and issue after filling in org name / CISO / effective date. | ISMS Manager β†’ Board / Staff | | **IMP-UG** | Markdown | Implementation User Guide β€” how the ISMS Manager implements and operates the control. Roles, process steps, KPIs, review cycles. | ISMS Manager | | **IMP-TG** | Markdown | Implementation Technical Guide β€” step-by-step for the engineer. Commands, configs, vendor notes, hardening checklists. | Security Engineer | | **SCR** | Python 3.11+ | Assessment generator β€” `python3 generate_*.py` produces a structured Excel compliance workbook. Single dependency: `openpyxl`. | ISMS Manager β†’ Auditor | | **WKBK** | Excel (.xlsx) | Generated compliance workbook β€” per-control assessment items, evidence status, scoring, auditor notes. Output of the SCR generator. | Auditor / Control Owner | | **REF** | Markdown | Reference extracts from the ISO standard text mapped to this control. Cross-references to adjacent Annex A controls. | ISMS Manager / Auditor | | **CTX** | Markdown | Context document linking this control pack to adjacent and dependent packs β€” for control stacking and dependency mapping. | ISMS Manager | | **FORM** | Markdown | Ready-to-use templates: evidence forms, meeting agendas, approval records, risk acceptance forms. | ISMS Manager / Control Owner | **Operational product:** POL + SCR + WKBK only (no IMP-UG/TG β€” simpler by design) **Privacy / Cloud / AI:** POL + IMP-UG + IMP-TG + SCR + WKBK --- ## Top-Level Repository ``` factory_isms/ β”‚ β”œβ”€β”€ README.md # Project overview and quick start β”œβ”€β”€ PARADIGM.md # Product overview and paradigm shift guide β”œβ”€β”€ PLATFORM.md # Platform architecture, features, and full deployment guide (setup instructions included) β”œβ”€β”€ STRUCTURE.md # This file β”œβ”€β”€ COMPLIANCE.md # 29 compliance assessment modules β€” coverage notes β”œβ”€β”€ CONTRIBUTING.md # QA process and standards β”œβ”€β”€ PHILOSOPHY.md # Anti-cargo-cult methodology β”œβ”€β”€ CODE_OF_CONDUCT.md # Community standards β”œβ”€β”€ SECURITY.md # Vulnerability reporting policy β”œβ”€β”€ LICENSE # AGPL-3.0 β€” governs the content packs below (dual-licensed, see README Β§License) β”‚ β”œβ”€β”€ isms-core-framework/ # πŸ—οΈ ISO 27001:2022 β€” Full Engineering Product β”œβ”€β”€ isms-core-operational/ # ⚑ ISO 27001:2022 β€” Lightweight SME Product β”œβ”€β”€ isms-core-privacy/ # πŸ”’ ISO 27701:2025 β€” Privacy Extension Pack β”œβ”€β”€ isms-core-cloud/ # ☁️ ISO 27018:2025 Cloud Extension Pack + ISO 27017:2026 Cloud Sec β”œβ”€β”€ isms-core-ai/ # πŸ€– ISO 42001:2023 β€” AI Extension Pack β”œβ”€β”€ isms-core-platform/ # πŸ–₯️ Platform Deployment Package β€” own LICENSE (Apache 2.0) β”œβ”€β”€ USER_MANUAL/ # πŸ“– Full user manual (21 chapters) β”œβ”€β”€ CREDITS.md # Third-party tools and acknowledgements β”œβ”€β”€ COPYRIGHT # Copyright notice └── screenshots/ # Platform UI screenshots ``` --- ## πŸ—οΈ isms-core-framework/ β€” ISO 27001:2022 Full Engineering 53 control packs covering all 93 Annex A controls. Each pack contains the full artifact set (POL, IMP-UG, IMP-TG, SCR, WKBK, REF, CTX, FORM). ``` isms-core-framework/ β”‚ β”œβ”€β”€ README.md # Product overview β”œβ”€β”€ CONTROLS.md # 53 control pack index β€” start here β”œβ”€β”€ COVERAGE.md # 93 Annex A controls β†’ 53 pack mapping β”œβ”€β”€ STATUS.md # Implementation metrics β”œβ”€β”€ STACKING.md # Control grouping and stacking methodology β”œβ”€β”€ CHANGELOG.md # Version history β”‚ β”œβ”€β”€ 00-foundation-policies/ # Regulatory and governance baseline β”‚ β”œβ”€β”€ isms-pol-00-regulatory-applicability-framework/ β”‚ β”‚ └── POL/ # ISMS-POL-00 (EN + FR + DE + IT) β”‚ β”œβ”€β”€ isms-pol-01-isms-governance-and-decision-making-framework/ β”‚ β”‚ └── POL/ # ISMS-POL-01 (EN + FR + DE + IT) β”‚ └── isms-ref-00-regulatory-applicability-framework/ β”‚ └── REF/ # Regulatory requirement references (DORA, NIS2, PCI DSS, FINMA, EU AI Act) β”‚ β”œβ”€β”€ A.5-organisational-controls/ # 21 control packs β”‚ └── isms-a.5.X-X-control-name/ β”‚ β”œβ”€β”€ POL/ # Governance policy (EN + fr/ + de/ + it/) β”‚ β”œβ”€β”€ IMP/ # IMP-UG (User Guide β€” ISMS Manager) and IMP-TG (Technical Guide β€” Engineer) files, side by side β”‚ β”œβ”€β”€ SCR/ # Python assessment generator(s) β”‚ β”œβ”€β”€ WKBK/ # Generated Excel workbook(s) β”‚ β”œβ”€β”€ REF/ # ISO standard reference extracts β”‚ β”œβ”€β”€ CTX/ # Control context + dependency map β”‚ └── FORM/ # Templates and forms β”‚ β”œβ”€β”€ A.6-people-controls/ # 4 control packs (same structure) β”œβ”€β”€ A.7-physical-controls/ # 6 control packs (same structure) └── A.8-technological-controls/ # 22 control packs (same structure) ``` **Key files:** - `CONTROLS.md` β€” indexed list of all 53 packs with control names and Annex A references - `COVERAGE.md` β€” maps the 93 ISO 27001:2022 Annex A controls to the 53 packs (some packs cover multiple controls) - `STACKING.md` β€” explains how packs can be stacked for mature organisations --- ## ⚑ isms-core-operational/ β€” ISO 27001:2022 SME Edition 53 control groups with a lighter artifact set (POL + SCR + WKBK). No implementation guides β€” the operational policies are designed to be complete and self-contained. ``` isms-core-operational/ β”‚ β”œβ”€β”€ README.md β”œβ”€β”€ CONTROLS.md # 53 control group index β”œβ”€β”€ STATUS.md β”œβ”€β”€ CHANGELOG.md β”‚ β”œβ”€β”€ 00-checklist-engine/ # Shared checklist generator engine β”‚ β”œβ”€β”€ A.5-organisational-controls/ # 21 control groups β”‚ └── isms-a.5.X-X-control-name/ β”‚ β”œβ”€β”€ POL/ # OP-POL (EN + fr/ + de/ + it/) β”‚ β”œβ”€β”€ SCR/ # Python compliance checklist generator β”‚ └── WKBK/ # Generated Excel checklist β”‚ β”œβ”€β”€ A.6-people-controls/ # 4 control groups β”œβ”€β”€ A.7-physical-controls/ # 6 control groups └── A.8-technological-controls/ # 22 control groups ``` --- ## πŸ”’ isms-core-privacy/ β€” ISO 27701:2025 Privacy Extension Pack 21 control groups across three scopes: controller (a.1.x), processor (a.2.x), and shared (a.3.x). ``` isms-core-privacy/ β”‚ β”œβ”€β”€ README.md β”œβ”€β”€ 00-checklist-engine/ # Shared privacy checklist engine β”‚ β”œβ”€β”€ 00-priv-foundation-policies/ # Foundation policies β”‚ β”œβ”€β”€ priv-pol-00-privacy-regulatory-applicability-framework/ β”‚ β”‚ └── POL/ # PRIV-POL-00 (EN + fr/ + de/ + it/) β”‚ └── priv-pol-01-privacy-governance-and-decision-making/ β”‚ └── POL/ # PRIV-POL-01 (EN + fr/ + de/ + it/) β”‚ β”œβ”€β”€ privacy-controller/ # 8 controller control groups (a.1.x) β”‚ └── priv-a.1.X.X-X-control-name/ β”‚ β”œβ”€β”€ POL/ # PRIV-POL (EN + fr/ + de/ + it/) β”‚ β”œβ”€β”€ IMP/ # IMP-UG + IMP-TG files, side by side β”‚ β”œβ”€β”€ SCR/ β”‚ └── WKBK/ β”‚ β”œβ”€β”€ privacy-processor/ # 5 processor control groups (a.2.x) β”‚ └── priv-a.2.X.X-X-control-name/ # Same structure as controller β”‚ └── privacy-shared/ # 8 shared control groups (a.3.x) └── priv-a.3.X.X-X-control-name/ # Same structure as controller ``` --- ## ☁️ isms-core-cloud/ β€” ISO 27018:2025 Cloud Extension Pack + ISO 27017:2026 Cloud Sec 16 control groups across two standalone standards: 12 covering PII protection requirements for cloud service providers (ISO 27018:2025), and 4 standalone cloud security extension controls (ISO 27017:2026), plus a guidance addendum for the 38 existing Annex A controls that already apply in a cloud context. ``` isms-core-cloud/ β”‚ β”œβ”€β”€ README.md β”œβ”€β”€ iso27018-pii-cloud/ β”‚ └── cld-a.X-control-name/ # 12 Annex A control groups β”‚ β”œβ”€β”€ POL/ # CLD-POL (EN + fr/ + de/ + it/) β”‚ β”œβ”€β”€ IMP/ # IMP-UG + IMP-TG files, side by side β”‚ β”œβ”€β”€ SCR/ β”‚ └── WKBK/ └── iso27017-sec-cloud/ β”œβ”€β”€ cld-sec-a.X-control-name/ # 4 standalone extension controls β”‚ β”œβ”€β”€ POL/ # CLD-SEC-POL (EN + fr/ + de/ + it/) β”‚ β”œβ”€β”€ IMP/ # IMP-UG + IMP-TG files, side by side β”‚ └── SCR/ └── cld-sec-guidance-addendum/ └── REF/ # existing-control guidance for the 38 remaining Annex A controls ``` --- ## πŸ€– isms-core-ai/ β€” ISO 42001:2023 AI Extension Pack 12 AI control groups (2 foundation + 10 Annex A) covering AI governance, impact assessment, responsible use, and third-party AI relationships. ``` isms-core-ai/ β”‚ β”œβ”€β”€ README.md β”œβ”€β”€ 00-checklist-engine/ # Shared AI checklist engine β”‚ β”œβ”€β”€ 00-ai-foundation-policies/ # Foundation policies β”‚ β”œβ”€β”€ ai-pol-00-aims-regulatory-applicability-framework/ β”‚ β”‚ └── POL/ # AI-POL-00 (EN + fr/ + de/ + it/) β”‚ └── ai-pol-01-aims-governance-and-decision-making/ β”‚ └── POL/ # AI-POL-01 (EN + fr/ + de/ + it/) β”‚ └── ai-a.X.X-X-control-name/ # 10 Annex A control groups β”œβ”€β”€ POL/ # AI-POL (EN + fr/ + de/ + it/) β”œβ”€β”€ IMP/ # IMP-UG (User Guide) + IMP-TG (Technical Guide) files └── SCR/ # Python compliance checklist generator ``` --- ## πŸ–₯️ isms-core-platform/ β€” Platform Deployment Package The Docker Compose deployment package. **Images-only distribution** β€” this directory ships no application source, only what's needed to *run* the stack. `docker-compose.yml` pulls pre-built images (`isms-core-backend`, `-frontend`, `-nginx`, `-opensearch`, `-connectors`, `-feeds`, `-threat-intel`, `-smtp-bridge`, plus one-shot setup/data images) from GHCR, Docker Hub, and a private registry. Full application source (backend, frontend, connectors, feeds, threat-intel, smtp-bridge, nginx, opensearch, datasets) lives in the private `factory_isms_project` working repo and is built into those images β€” it is not part of this public repo. ``` isms-core-platform/ β”‚ β”œβ”€β”€ .env.example # Environment variable template β†’ copy to .env β”œβ”€β”€ backup.env.example # Backup-service environment template β”œβ”€β”€ docker-compose.yml # Multi-service production stack (profile-based, image: not build:) β”œβ”€β”€ bootstrap.sh # First-boot import script (idempotent, safe to re-run) β”œβ”€β”€ CHANGELOG.md # Platform release notes β”œβ”€β”€ LICENSE # Apache 2.0 β€” governs this directory only (see README Β§License) β”œβ”€β”€ .gitignore β”‚ β”œβ”€β”€ .env.connector-certs.example # Template for the legacy connector-certificate file (certificates are normally trusted in the WebUI) β”‚ β”œβ”€β”€ garage/ # Garage S3 object store (optional profile) β€” upstream image, config only β”‚ β”œβ”€β”€ garage.toml # Garage configuration, bind-mounted into dxflrs/garage β”‚ └── tls-proxy.conf # TLS proxy in front of Garage (HTTPS-only S3, v1.3) β”‚ β”œβ”€β”€ schemas/ β”‚ └── init_db.sql # PostgreSQL initial schema, bind-mounted into postgres:18-alpine β”‚ └── certs/ # TLS certificate mount point (gitignored β€” runtime only) β”œβ”€β”€ cert.pem # Custom cert (optional β€” auto-generated if absent) └── key.pem # Private key (optional) ``` **Services started by `docker-compose.yml`:** | Container | Role | |-----------|------| | `isms-core-nginx` | TLS termination + reverse proxy | | `isms-core-backend` | FastAPI REST API | | `isms-core-frontend` | Angular 22 + Material 3 WebUI | | `isms-core-postgres` | PostgreSQL 18 β€” primary data store | | `isms-core-redis` | Redis 8 β€” session cache + Celery broker | | `isms-core-opensearch` | OpenSearch 3.x β€” full-text search + threat intelligence | | `isms-core-worker` | Celery worker β€” background import and sync tasks | | `isms-core-beat` | Celery Beat β€” nightly evidence archive (02:00 UTC), daily KPI snapshot (06:00 UTC) | | `isms-core-feeds` | Threat intelligence scheduler β€” MITRE ATT&CK, ATLAS, CISA KEV, EPSS, NVD CVE/CPE, ENISA EUVD | | `isms-core-connectors` | Automated evidence runner β€” 46 connectors, runs continuously | | `isms-core-dashboards-setup` | One-shot OpenSearch Dashboards provisioning β€” imports 20 automated dashboards at startup | Compose profiles β€” set `COMPOSE_PROFILES` in `.env` (no `--profile` flags needed on the command line): - `opensearch-single` β€” **required** for standard deployment (starts OpenSearch) - `threat-intel` β€” OSINT IOC feeds (CIRCL MISP, Botvrij, AbuseIPDB, URLhaus, ThreatFox, SSLBL, AlienVault OTX, Feodo Tracker, RFD, Stopforumspam, MalwareBazaar, Malpedia); requires `THREAT_INTEL_ENABLED=true` in `.env` - `opensearch-cluster` β€” 3-node OpenSearch cluster (enterprise) - `dashboards` β€” OpenSearch Dashboards UI on port 5601 - `garage` β€” Garage S3 object store - `mailpit` β€” local email catcher (dev) - `smtp-bridge` β€” Microsoft 365 / OAuth email relay --- ## πŸ“ Translation Subdirectories All POL documents (across all five products) are available in English and three additional languages. The English document lives in `POL/` directly. Translations live in language subdirectories: ``` POL/ β”œβ”€β”€ ISMS-POL-A.5.1 - Information Security Policies.md # English (canonical) β”œβ”€β”€ fr/ β”‚ └── ISMS-POL-A.5.1 - Politique de SΓ©curitΓ© de l'Information - FR.md β”œβ”€β”€ de/ β”‚ └── ISMS-POL-A.5.1 - Informationssicherheitsrichtlinie - DE.md └── it/ └── ISMS-POL-A.5.1 - Politica di Sicurezza delle Informazioni - IT.md ``` The same pattern applies to OP-POL, PRIV-POL, CLD-POL, and AI-POL files. --- ## πŸ“‹ Screenshots/ Platform UI screenshots referenced in README.md and PLATFORM.md. `light/` and `dark/` subfolders, named `NN_isms_core_feature_name_.png`. Docs use light only. ---

Copyright Β© 2025–2026 The ISMS Core Project. All rights reserved.