Skip to content

Architecture and Modules en

Jump to bottom
coolstartnow edited this page Aug 30, 2026 · 1 revision

Architecture & Modules

🇩🇪 Deutsche Version

Code structure

server/
  index.js          — Express app setup, router mounts
  auth.js           — JWT auth, RBAC ranks, session
  routes/            — 17 Express route modules (one per domain)
  db/                 — Data stores (jsonStore / sqliteStore / orgSettingsStore / …)
  ai/                 — Semantic search (embedder, embeddingStore, lexicalSearch)
  reports.js          — Report generation logic
ui/
  index.html          — SPA shell (Atlassian Dark Theme)
  app.js              — all render functions, ~6000 lines vanilla JS
  style.css           — CSS variables, dark theme
data/                 — JSON files / SQLite DB (gitignored)
docs/
  ISMS-build-documentation.md  — full architecture reference
  architecture/                — C4 diagrams, data model, OpenAPI 3.0.3 spec
tests/                 — Jest + Supertest (176 tests, --runInBand)
  • Auth: JWT cookie (sm_session), bcrypt passwords, TOTP 2FA (enforceable org-wide)
  • RBAC: reader → editor / dept_head → contentowner / auditor → admin
  • Persistence: JSON files (default/demo) or SQLite/MariaDB/PostgreSQL via Knex
  • AI: Optional local Ollama (nomic-embed-text); keyword search always available as fallback
  • Audit Log: every create/update/delete/login action recorded, filterable, exportable

See docs/architecture/ in the repo for C4 diagrams, the full data model, and the OpenAPI 3.0.3 spec (80+ endpoints).

Module overview

Module Description Standards
Policy Management Template CRUD, versioning, lifecycle (draft → review → approved → archived), space hierarchy, attachments ISO 27001 §5
Statement of Applicability 313 controls across 8 frameworks, inline editing, gap analysis, cross-mapping ISO 27001 A / BSI / NIS2 / EUCS / EUAI / ISO 9001 / CRA
Risk Management Risk register, treatment plans, auditor role ISO 27001 §6.1
Security Goals KPI tracking with progress bars, calendar integration ISO 27001 §6.2
GDPR & Privacy VVT, AV-contracts, DSFA, TOMs, DSAR queue, 72h-timer, deletion log with email alerts DSGVO Art. 13–35
Asset Management Asset register, editable asset types, protection goals (CIA + authenticity) with dependency inheritance, classification levels, EoL tracking ISO 27001 A.5.9–5.12
BCM / BCP Business Impact Analysis, continuity plans, exercises ISO 27001 A.5.29–5.30 / NIS2
Training Records Training catalogue, completion tracking, certificate upload ISO 27001 A.6.3
Supplier Management Vendor register, audit scheduling, risk assessment ISO 27001 A.5.19–5.22
Legal & Contracts Contracts, NDAs, privacy policies, expiry calendar
Incident Inbox CISO inbox + public reporting form (no login required) NIS2 / BSI
Governance Management reviews, action tracking ISO 27001 §9.3
Reports Compliance matrix (Control × Entity), gap report, review cycles, CSV export
Audit Findings Finding register (IST→SOLL→Risk→Recommendation), action plans, severity/status tracking, FIND-YYYY-NNNN ref ISO 27001 §9.2
Traceability Every record links to SoA controls + policy documents — bidirectional
Semantic Search Local AI search via Ollama (nomic-embed-text) with keyword fallback
Multi-Entity Corporate structure tree, per-entity applicability for controls and policies
Multilingual UI & Demo Data Full UI and demo content in 🇩🇪 DE / 🇬🇧 EN / 🇫🇷 FR / 🇳🇱 NL

Detailed module documentation per area (DE/EN/FR/NL) lives in the repo under docs/module-*.md.

⚠ Important: ISO controls require manual installation

ISO 27001:2022, ISO 9000:2015, and ISO 9001:2015 are copyright-protected standards published by ISO. The control definitions (titles, descriptions, requirement text) are not included in this software and must not be redistributed without a valid ISO licence.

The SoA modules for ISO 27001, ISO 9000, and ISO 9001 therefore ship without control content — the administrator must manually import it (obtain a licensed copy, prepare a JSON file, run bash scripts/import-iso-controls.sh path/to/iso-controls.json). Frameworks usable without an ISO licence: BSI IT-Grundschutz, EU NIS2, EUCS, EU AI Act, and CRA — based on publicly available EU legislation and German federal publications, fully pre-installed.

Clone this wiki locally