Official document templates for isms.sh.
| Template | Standard | Description |
|---|---|---|
iso27001 |
ISO/IEC 27001:2022 | Information security management |
nist-800-53 |
NIST SP 800-53 Rev 5 | Security and privacy controls |
pci-dss |
PCI DSS v4.0.1 | Payment card data security |
soc2 |
SOC 2 Type II | Service organization controls |
dora |
DORA | Digital operational resilience (EU) |
hipaa |
HIPAA Security Rule | Healthcare information security |
nist-csf |
NIST CSF 2.0 | Cybersecurity risk management |
iso42001 |
ISO/IEC 42001:2023 | AI management |
iso9001 |
ISO 9001:2015 | Quality management |
nis2 |
NIS2 Directive | Network and information security (EU) |
iso14001 |
ISO 14001:2015 | Environmental management |
iso45001 |
ISO 45001:2018 | Occupational health and safety management |
isqm |
ISQM 1, ISQM 2 & ISA 220 | Quality management for audit & assurance firms |
Templates are scaffolded into an organization's git repository. After scaffolding, the org owns the content — templates are not referenced again at runtime.
isms init --template iso27001
# or via web UI: Admin → Templates → Add
Each template is a directory of markdown files with YAML frontmatter:
iso27001/
├── meta.yaml # Template identity
├── clauses/
│ ├── .title # Folder display name ("Clauses")
│ ├── 04-context-of-the-organisation/
│ │ ├── .title # "Context of the Organisation"
│ │ ├── 4.01-external-and-internal-issues.md
│ │ ├── 4.02-needs-and-expectations.md
│ │ └── ...
│ └── ...
└── controls/
├── .title # "Controls"
├── a.05-organizational-controls/
│ ├── .title # "Organizational Controls"
│ ├── a.5.01-policies-for-information-security.md
│ └── ...
└── ...
Required. Identifies the template:
id: "iso27001"
name: "ISO/IEC 27001:2022"
description: "Information security management based on ISO/IEC 27001:2022"
version: "1.0"
maintainer: "isms.sh <team@isms.sh>"Each markdown file is a document with YAML frontmatter:
---
document_id: "iso27001-a-8-2"
title: "A.8.2 Privileged Access Rights"
status: "draft"
---
# Privileged access rights
Restrict and manage the allocation and use of privileged access rights...document_id— unique, lowercase, hyphenated. Used for linking and URL routing.title— human-readable document name.status— starts asdraft. Managed by the review workflow.
Optional. Provide display names for folders in the web UI:
Controls
Without a .title file, the folder's directory name is shown.
- Directories: zero-padded for sorting (
04-context-of-the-organisation) - Files: section number + slug (
4.01-external-and-internal-issues.md) - Document IDs: template prefix + section (
iso27001-4-1,iso27001-a-5-1)
- Create a directory with your template ID (lowercase, no spaces)
- Add
meta.yamlwith id, name, description, version, maintainer - Create subdirectories for document groups
- Add
.titlefiles for display names - Add markdown files with
document_id,title,statusfrontmatter - Set
ISMS_TEMPLATE_PATHto the parent directory
The platform discovers templates automatically — any directory with a valid meta.yaml becomes available.
Contributions welcome. To add or improve a template:
- Fork this repository
- Add or modify template files
- Ensure all documents have valid
document_idandtitlefrontmatter - Bump the
versioninmeta.yaml - Submit a pull request
Apache License 2.0 — see LICENSE.
Copyright 2026 UniDoc ehf. — isms.sh