# Isms-document-workflow **URL:** \ **Category:** Show & Tell\ **Created:** [10 March 2026 20:45 UTC](https://ifnotnil.com/t/isms-document-workflow/4659 "2026-03-10T20:45:31Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![TomasJ](https://ifnotnil.com/user_avatar/ifnotnil.com/tomasj/32/4998_2.png) [@TomasJ](https://ifnotnil.com/u/TomasJ)\ **Post date:** [10 March 2026 20:45 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/1 "2026-03-10T20:45:31Z")
The last couple of days I was in the rabbithole and created a git driven document workflow for information management systems. Basically a bunch of bash scripts, but well structured with a deterministic build process to create PDF documents and PDF forms based on markdown documents but with frontmatter, a pre- and post-processor. Minimalistic dependencies, free and open source, > **[isms-document-workflow](https://codeberg.org/tomas-jakobs/isms-document-workflow)** > > This repository is a template for an Information Security Management System (ISMS) document workflow (ISO 27001, TISAX or other compliance frameworks). P.S: using this for many years for my blog and whitepapers, so it’s quite “battle hardend” Enjoy! ---
**Author:** ![TomasJ](https://ifnotnil.com/user_avatar/ifnotnil.com/tomasj/32/4998_2.png) [@TomasJ](https://ifnotnil.com/u/TomasJ)\ **Post date:** [4 May 2026 19:30 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/2 "2026-05-04T19:30:22Z")
in the meantime the isms-document-work got an name: “Epyy”, a mascot and an internet-domain: > **[Epyy - Der freie ISMS-Dokumenten-Workflow](https://epyy.de)** > > Freier ISMS-Dokumenten-Workflow für Unternehmen, die Ihr ISMS selbst betreiben möchten. Today, I’ve uploaded a landingpage (in German langaugae) made with Hugo, a static page generator. ---
**Author:** ![thorstenstueker](https://ifnotnil.com/letter_avatar_proxy/v4/letter/t/aca169/32.png) [@thorstenstueker](https://ifnotnil.com/u/thorstenstueker)\ **Post date:** [5 May 2026 09:10 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/3 "2026-05-05T09:10:53Z")
Really, really nice project, thanks for adding it. Looks great and solves the 27001 problems for the most small businesses. ---
**Author:** ![npalardy](https://ifnotnil.com/user_avatar/ifnotnil.com/npalardy/32/10_2.png) [@npalardy](https://ifnotnil.com/u/npalardy)\ **Post date:** [5 May 2026 14:56 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/4 "2026-05-05T14:56:54Z")
Guess I’m out of the loop here What problem does this solve ? Can you explain it to me in a quick post ? ---
**Author:** ![thorstenstueker](https://ifnotnil.com/letter_avatar_proxy/v4/letter/t/aca169/32.png) [@thorstenstueker](https://ifnotnil.com/u/thorstenstueker)\ **Post date:** [5 May 2026 15:55 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/5 "2026-05-05T15:55:32Z")
It’s a document workflow following to IEC 27001 which allows you to work with your documents following to the standard which is often in use in industries. We have a workflow like this in our system, we implemented it different but this is for free especially for small companies which have to follow this standard while their customers would otherwise not doing contracting. ---
**Author:** ![npalardy](https://ifnotnil.com/user_avatar/ifnotnil.com/npalardy/32/10_2.png) [@npalardy](https://ifnotnil.com/u/npalardy)\ **Post date:** [5 May 2026 16:02 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/6 "2026-05-05T16:02:29Z")
So this software set up handles the documentation aspects of an ISMS - not the implementation of one ? Correct ? Just trying to get past “it follows a standard” kind of explanation as to what it DOES ---
**Author:** ![TomasJ](https://ifnotnil.com/user_avatar/ifnotnil.com/tomasj/32/4998_2.png) [@TomasJ](https://ifnotnil.com/u/TomasJ)\ **Post date:** [5 May 2026 18:41 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/7 "2026-05-05T18:41:11Z")
ISO 27001 is like an operating system for organisations when it comes to information security. You need to be able to provide evidence of everything: - What rules and processes are in place? - Who is responsible for what? - When was this last checked? - What has changed? - Is everything continuously improved? Many manage their ISMS in Word and Excel. But this does not meet the requirements. Changes, for instance, cannot be traced. Nobody knows which version is the latest etc. This is where this document worklow comes into play, with Git as Audit-trail and Markdown serving as the single source of truth. However, the strength of this workflow lies in the snippets that automate everything. For example, checking other documents whether a control (checkbox) is selected or not. Here in Europe, companies of significance or critical importance must demonstrate that they take information security seriously. Managing directors are held personally accountable, see NIS2 regulation. ---
**Author:** ![thorstenstueker](https://ifnotnil.com/letter_avatar_proxy/v4/letter/t/aca169/32.png) [@thorstenstueker](https://ifnotnil.com/u/thorstenstueker)\ **Post date:** [5 May 2026 19:25 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/8 "2026-05-05T19:25:39Z")
Exactly. And this standard is used as IEC standard also by Deloitte USA for example. And if you want to be deliverer in that structure you also have to fulfill that standard. For european vendorf less complex cause for us it is normal for long time now. ---
**Author:** ![npalardy](https://ifnotnil.com/user_avatar/ifnotnil.com/npalardy/32/10_2.png) [@npalardy](https://ifnotnil.com/u/npalardy)\ **Post date:** [5 May 2026 23:53 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/9 "2026-05-05T23:53:14Z")
Thanks for that description So this really serves as the back boy for a well documented information security system But it ISNT the actual implementation of any system Just the documentation portion Nothing wrong with that I just wanted to understand what this addressed ---
**Author:** ![npalardy](https://ifnotnil.com/user_avatar/ifnotnil.com/npalardy/32/10_2.png) [@npalardy](https://ifnotnil.com/u/npalardy)\ **Post date:** [5 May 2026 23:54 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/10 "2026-05-05T23:54:50Z")
Makes sense its like many other ISO standards where documenting the processes is as big a component of the process as anything ---
**Author:** ![TomasJ](https://ifnotnil.com/user_avatar/ifnotnil.com/tomasj/32/4998_2.png) [@TomasJ](https://ifnotnil.com/u/TomasJ)\ **Post date:** [6 May 2026 01:56 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/11 "2026-05-06T01:56:58Z")
Exactly and here is my USP: Some companies esp. SMEs buying expensive SaaS solutions with harmful side-effects. For instance: Vendors often claim, that “their” templates are copyrighted. When you cancel your SaaS subscription (e.g. to move everything inhouse) then you are not entiteld to use your documentation anymore. This means you must rewrite everything from the scratch. These legal issues, technical debts and uncertainty are not acceptable at all. Free software protects your long.time ISMS investment. ---
**Author:** ![thorstenstueker](https://ifnotnil.com/letter_avatar_proxy/v4/letter/t/aca169/32.png) [@thorstenstueker](https://ifnotnil.com/u/thorstenstueker)\ **Post date:** [6 May 2026 08:30 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/12 "2026-05-06T08:30:30Z")
That’s a real problem especially when leaving the vendor alone. But you delivered a solution which has non of this problems. ---
**Author:** ![npalardy](https://ifnotnil.com/user_avatar/ifnotnil.com/npalardy/32/10_2.png) [@npalardy](https://ifnotnil.com/u/npalardy)\ **Post date:** [6 May 2026 15:28 UTC](https://ifnotnil.com/t/isms-document-workflow/4659/13 "2026-05-06T15:28:56Z")
Ah yes Vendor Lock in ! Gotta love it Seen it so many times in so many ways At least now I have a much better idea what this project does & how it helps Thanks !