Base
Open sourceCommon card types, workflows, field types, link types and the reports everything else builds on. You rarely interact with it directly, but it is what makes the other modules interoperable.
Start from someone else's homework
A module is a reusable package of card types, workflows, templates, link types and logic rules. Import one and you have a working process to start from. Adapt it and it becomes yours.
The practice itself is content, kept under version control, which means you can read it, fork it and change it.
Modules stack
Each layer builds on the one below it, and the subscription modules attach to the layer they extend. That is why adding EU CRA to a project does not mean starting again, and why a team already doing secure development is most of the way to IEC 62443-4-1.
EU CRA Essentials
Open sourceThe essential requirements of the EU Cyber Resilience Act.
builds on Secure Development Essentials
Secure Development Essentials
Open sourceWhat a development team needs to start doing secure development.
builds on ISMS Essentials
IEC 62443-4-1
SubscriptionSecure product development lifecycle for industrial systems.
extends Secure Development Essentials
IEC 81001-5-1
SubscriptionSecure development lifecycle for health software.
extends Secure Development Essentials, in development
ISMS Essentials
Open sourceBuilding blocks for an information security management system.
builds on Base
ISO/IEC 27001
SubscriptionFull coverage of the information security management standard.
extends ISMS Essentials
Base
Open sourceThe foundation every Cyberismo project imports.
The standards modules share internal foundations, so an organisation working to more than one standard does the underlying work once rather than twice.
The catalogue
ISMS Essentials
Open sourceAsset management, risk management, incident management, and the essential process descriptions an ISMS needs. This is where a company-level security management system starts, and it is the layer everything about organisational security sits on.
What you can show an auditor: A risk register, an asset register, incident records, and the process documentation an auditor asks to see.
Builds on Base Source on GitHub
Secure Development Essentials
Open sourceHigh-level risk assessment, threat modelling with automatically generated data flow diagrams, security requirements, security issue tracking, and built-in progress metrics. Because it builds on ISMS Essentials, the risks a team identifies live in the same model as the risk management of the organisation.
What you can show an auditor: Threat models, security requirements linked to the components they protect, and a maturity view per project.
Builds on ISMS Essentials Source on GitHub
EU CRA Essentials
Open sourceThe essential requirements of the CRA expressed as content you work through, mapped onto the secure development practices underneath. Adds the obligations the regulation places on a product, rather than replacing the process you already have.
What you can show an auditor: Evidence against the CRA Annex I essential requirements, generated from the work rather than written up afterwards.
Builds on Secure Development Essentials Source on GitHub
ISO/IEC 27001
SubscriptionFor organisations working towards or maintaining ISO/IEC 27001 certification. Extends ISMS Essentials with the complete control set, mapped to the questions an auditor will ask, and the automated checks that tell you which controls are not yet supported by evidence.
What you can show an auditor: A Statement of Applicability, control-by-control status with explanations, and an audit-ready evidence trail.
Builds on ISMS Essentials How to get it
IEC 62443-4-1
SubscriptionTasks and templates for establishing and maintaining a secure development process across an organisation, with a compliance report mapped to the standard. This is the module behind the certification work our consultants have run with industrial customers.
What you can show an auditor: A compliance report mapped to the IEC 62443-4-1 practices, and the process documentation a certification body expects.
Builds on Secure Development Essentials How to get it
IEC 81001-5-1
SubscriptionThe health software equivalent of the industrial secure development standard, for medical device and health IT manufacturers. It will share its foundations with the IEC 62443-4-1 module, so an organisation working to both standards does the work once.
What you can show an auditor: Evidence against the IEC 81001-5-1 lifecycle requirements, alongside your existing medical device documentation.
This module is under development and not yet available. If your timeline depends on it, ask us where it currently stands.
Builds on Secure Development Essentials
Tailoring a module
An imported module is read-only inside your project, so updates stay clean. What you build on top is yours: your own card types, your own workflows, your own logic rules, your own reports. Most teams change something in the first month.
One customer combined the NIS2 and GDPR requirements into a single view and added percentage progress tracking, because that was how their management wanted to see it. Their CEO did that himself, and it is a normal amount of tailoring.
If you want a module of your own, with your organisation's process packaged so that every team imports the same thing, that is one of the things our consultants do.
Contact
- 01
A short conversation
Thirty minutes on what you are trying to achieve and which standards apply.
- 02
A concrete proposal
Which modules, hosted or self-run, what adoption support you would want, and what it costs.
- 03
You try it first
We recommend that your team tries the open-source version before you buy anything.
Cyberismo is based in Tampere, Finland. We work smoothly with teams anywhere in the world.