Free ISMS Software: Open Source and Free Plans Compared

Free ISMS software comes in two forms: open source and community editions such as verinice, CISO Assistant and eramba Community, which you run yourself, and time-limited free plans such as the fuentis Suite Basic plan: €0 for 12 months from contract start, 1 named user, up to 500 ISMS objects. Licence-free does not mean cost-free. Operation, updates, catalogue maintenance and support always cost time or money.

How the choice plays out in practice, according to the author:

„

The licence is rarely the biggest cost item for an ISMS tool. It gets expensive when nobody maintains the catalogues. From 1 January 2027, according to the BSI, applications for ISO 27001 certification on the basis of Grundschutz++ can be submitted, and a self-hosted tool only keeps up if someone in-house installs the updates and checks the mappings. Answer that question before selection, not before the audit.

Srdan Manasijevic, CEO fuentis

What free and open source ISMS software is available in 2026?

In 2026, four options qualify as free ISMS software: verinice (open source, AGPL, rooted in IT-Grundschutz), CISO Assistant Community (AGPLv3, more than 200 frameworks), eramba Community (free, self-hosted) and a free plan (SaaS, €0 for 12 months from contract start). Excel remains the status quo. The options differ mainly in who operates and who maintains catalogues.

Sources: vendor websites for verinice, CISO Assistant and eramba, plus the pricing page of the Basic plan. As of 21 October 2026.

The table reflects vendor information without rating it; this article's publisher offers one of the options. For a broader overview beyond free options, see ISMS tools from Germany compared.

What do the free ISMS tools offer in detail?

The details show what each option handles and what stays with you.

Is verinice free and open source?

Yes, verinice is open source, but only the source code is free. The vendor SerNet GmbH states: "Since 2006, verinice has been produced completely open source by SerNet GmbH." Rooted in IT-Grundschutz, the tool, according to the verinice website, also supports ISO 27001, NIS2 and VDA ISA, including licensed IT-Grundschutz content. It runs in the cloud or on-premise.

The vendor publishes SerNet's own code under the AGPL, freely available on GitHub. The verinice.PRO Server is GPLv3-licensed but sold as a subscription, priced on request.

verinice.cloud offers a free trial instance for roughly two months, then a subscription. According to verinice.SHOP, the on-premise bundles start at €5,750 per year. SerNet provides the classic single-user version and verinice.PRO until 31 December 2027; as successors, the vendor offers verinice.cloud and verinice.onprem.

verinice suits Grundschutz-focused organisations with their own IT operations or a subscription budget.

What does CISO Assistant Community offer as an open source ISMS?

CISO Assistant Community by intuitem is a self-hosted open source ISMS with no licence costs.

• Licence and price: AGPLv3, except for the "enterprise" folder, which has a commercial licence; according to the pricing page, €0 with no time limit ("forever").
• Frameworks: more than 200, including ISO 27001:2022 and the BSI IT-Grundschutz Compendium.
• Operation: via Docker or Docker Compose, alternatively Kubernetes; support through the community.
• Pro version: SaaS from €39 per contributor per month with annual billing, with priority support, premium features, and hosted updates and backups.

The Community Edition suits teams with container know-how. Pro-only features, such as an audit log, per-object change history and Jira or ServiceNow integrations, are listed in intuitem's edition comparison.

What is missing from eramba Community?

eramba Community is the free, self-hosted edition of the GRC software eramba, with no user or time limit according to the vendor. The vendor does not name a licence on its website.

It covers four of seven use cases: Risk, Compliance, Data Privacy and Incidents (eramba's edition comparison).

Excluded are GRC templates (compliance frameworks, policies, internal controls, questionnaires), REST APIs, reporting, automations and support.

You install upgrades yourself; help comes via forum and documentation. The installation page also notes: "eramba cannot run fully offline". Minimum requirements are 1 vCPU, 4 GB RAM and 10 GB swap.

What does the fuentis Basic free plan include?

fuentis Basic, listed on the pricing page as "free/Basic", costs €0 for 12 months from contract start. The software is not open source. It runs as SaaS operated by the provider; on-premise is Enterprise-only.

You get 1 named user, 1 unit, 1 scope and up to 500 ISMS objects. It includes structure analysis, protection requirements assessment, risk analysis, security checks, incident management, ISMS monitoring, BSI IT-Grundschutz and ISO 27001.

GAP analysis and the catalogue manager start with the Standard plan. The pricing page lists the features of all plans.

After 12 months, you move to a paid plan with your existing data (Standard: €379 per month) or keep the data stored for €79 per month, both plus VAT.

According to the vendor, ISO 27001 certification is possible with the free version, depending on the size of the organisation and the project; larger organisations and groups may hit limits. Activation requires a business email address and your company name. The product page describes the structure of the ISMS module of the fuentis Suite.

Are Excel and Word enough for a free ISMS?

Many organisations start their ISMS with Excel spreadsheets and Word templates because the licences already exist. Every change exposes the limits: assets, protection requirements, risks and controls in separate files are not linked, so each adjustment means manual work across several documents. How far you get without software is covered in building an ISMS without a tool.

What does "free" ISMS software really cost?

Free ISMS software saves you the licence, not the operation. Hosting, updates, catalogue maintenance, standards texts and support remain, and regulatory pressure is rising: since the NIS-2 Implementation Act, around 29,500 entities instead of the previous roughly 4,500 fall under BSI regulation. What matters is who handles these tasks in-house long term.

According to the BSI, these entities are required to implement risk management measures and to document them. A half-maintained tool becomes a documentation gap. The Bitkom Wirtschaftsschutz 2026 study puts the damage from theft, espionage and sabotage at €211 to €270.8 billion, of which 76% (€160.4 to €205.8 billion) is caused by cyberattacks.

The catalogues are changing too. From 1 January 2027, according to the BSI, applications for ISO 27001 certification on the basis of Grundschutz++ can be submitted. The certifiability of IT-Grundschutz ends on 30 November 2031, according to the BSI, and the "Stand der Technik" (state of the art) library replaces the IT-Grundschutz Compendium. Self-hosting means installing new catalogues and checking the mappings yourself.

You buy the standard text separately in any case: ISO/IEC 27001:2022 costs CHF 155 in the IEC Webstore. The processes an ISMS tool needs to cover determine the remaining items:

Plan your exit in advance for every option: a free plan ends on a fixed date, the classic verinice generation runs until 31 December 2027, and eramba Community has to be updated manually.

Which free ISMS tool fits your situation?

Want to run IT-Grundschutz yourself with admin capacity? Look at verinice. Need many frameworks and have container know-how? Try CISO Assistant Community. Want to start with ISO 27001 and IT-Grundschutz without your own server? Use a free plan such as fuentis Basic and schedule the decision at 12 months.

If you think of GRC more broadly than ISMS and want to manage risks, data protection and incidents in one system, eramba Community is an option. The prerequisite: you can get started without prebuilt framework templates and without vendor support.

A quick reality check for the free plan: before registering, estimate how many objects your structure analysis will include, because Basic covers up to 500 ISMS objects and one scope. The ISMS module of the fuentis Suite shows the functions behind it. If the scope fits, register for the Basic plan and decide right away what happens after 12 months: a paid plan or continued data storage.

Frequently asked questions

Is there an open source ISMS?

Yes. verinice by SerNet has been developed as open source since 2006, SerNet's own code is licensed under the AGPL, and its roots are in IT-Grundschutz. CISO Assistant Community is licensed under AGPLv3 and ships with more than 200 frameworks, including ISO 27001:2022 and the BSI IT-Grundschutz Compendium. You run both yourself; vendor-operated verinice versions are paid.

Can I use an ISMS tool for free indefinitely?

Yes, with open source and community editions. According to the vendor, eramba Community has no user or time limit, and CISO Assistant Community costs €0 with no time restriction. Operation, updates and backups are then on you. The fuentis Suite free plan differs: fuentis Basic is limited to 12 months from contract start.

Can I get ISO 27001 certified with free ISMS software?

It is your organisation's ISMS that gets certified, not the tool; auditors assess processes and evidence. For the Basic plan, fuentis states that ISO 27001 certification is possible depending on the size of the organisation and the project. Larger organisations and groups may hit limits. You buy the standard text separately in any case, for CHF 155 in the IEC Webstore.

What happens when a free plan expires?

With fuentis Basic, free use ends 12 months after contract start. You then move to a paid plan, keeping your existing data, or keep the data stored for €79.00 per month. According to the pricing page, an export to another provider is possible where feasible and is billed on a time-and-materials basis ("Time & Material"). All prices are plus VAT.