Skip to content

FAQ en

Jump to bottom
coolstartnow edited this page Aug 30, 2026 · 1 revision

FAQ

🇩🇪 Deutsche Version

Is ISMS Builder a hosted service?

No. ISMS Builder is self-hosted only — no cloud, no SaaS fees, no managed service. Deployment, TLS, hardening, backups, updates, and access control are yours. See Home for the full intended use and scope.

Does ISMS Builder replace certification or legal advice?

No. The tool helps organise and evidence the work towards ISO 27001, NIS2, GDPR/DSGVO, and BSI IT-Grundschutz — the actual assessment remains yours and your auditor's.

What's the fastest way to get started?

Easiest via the published Docker image, see Docker: Using the image & environment variables. For a local Node.js install without Docker:

git clone https://github.com/coolstartnow/isms-builder.git
cd isms-builder
npm install
cp .env.example .env
npm start

Log in with admin@example.com / adminpass — change the password immediately.

Why aren't the ISO 27001 controls included?

Because ISO 27001, ISO 9000, and ISO 9001 are copyright-protected standards that cannot be redistributed without a licence. BSI IT-Grundschutz, NIS2, EUCS, EU AI Act, and CRA are fully pre-installed instead, since they're based on publicly available legislation. Details: Architecture & Modules.

How do I move from demo data to real production use?

Use the interactive production-prep tool instead of a fresh install — it clears demo/test content module by module (or all at once) without touching real data you've already entered, and always creates a backup first:

bash stop.sh
node scripts/prepare-production.js
bash start.sh

Where do I report bugs or security issues?

Regular bugs/feature requests as a GitHub Issue. Please don't report security issues publicly — use private vulnerability reporting instead, details in SECURITY.md.

Who maintains the project, and how fast is the response time?

One person, alongside a full-time job. Issues and discussions are usually answered within days; security reports are prioritised. For fixed timelines or guaranteed response times, a commercial vendor is the honest recommendation.

Clone this wiki locally