IT-GRC Portal — ISO 27001:2022

01Overview

IT-GRC Portal is a self-hosted, open-source Governance, Risk & Compliance platform built specifically to run an ISO/IEC 27001:2022 ISMS end to end. Instead of a spreadsheet graveyard of controls and evidence, it ships all 93 Annex A controls and all 30 mandatory management-system clauses (4-10) pre-seeded on first boot, then gives every module a real workflow: owners, review dates, conformity status, tasks, approvals, and audit-tracked sign-off. Clone it, `docker compose up`, and you have a working ISMS the same afternoon - local JWT accounts work out of the box, with SAML/OIDC left as optional, blank-by-default config placeholders for wiring a corporate IdP later.

What sets it apart from a single-standard tool is the Unified Control Framework. Five catalogs live side by side - ISO 27001:2022 (93), ISO/IEC 27019:2024 energy-sector ENR controls (12), NIST CSF 2.0 (22 categories), SOC 2 Trust Services Criteria (13), and ISA/IEC 62443-2-1:2024 OT program elements (8) - joined by a control-to-control crosswalk (96 seeded mappings) and a cross-framework coverage matrix. That includes a rarely-seen IT-ISMS to OT-security bridge (66 ISO/27019 to IEC 62443 mappings), making this one of the few open GRC tools that speaks both the IT and the industrial/energy compliance dialects: test once, comply many.

The portal covers the full ISMS lifecycle: a 5x5 risk register with inherent-vs-residual scoring and a heat map, Statement of Applicability, CMMI-style maturity self-assessments and vendor questionnaires, the Clause 7.5 documented-information register (17 mandatory records), interested parties (4.2), IS objectives and KPI/KRI/KCI metrics with auto-derived RAG status (6.2/9.1), a supplier/third-party register (5.19-5.23), incident management (5.24-5.28), awareness & training (7.2/7.3), evidence, audits and findings, and policies with attestation. A daily posture snapshot feeds compliance, conformity, document-readiness and training-completion trend charts with no scheduler required.

It is aimed at CISOs, GRC managers, internal auditors, and control/risk owners who want to prepare for and maintain certification without paying for a proprietary SaaS GRC suite - while keeping their ISMS data inside their own perimeter. The stack is production-shaped (FastAPI async backend, React 18 SPA, PostgreSQL 16, Alembic migrations, RBAC with six roles) and CI-verified, but it is honest about its scope: it organizes and evidences your ISMS, it does not replace an accredited external audit.

02Key Capabilities

93 Annex A controls, pre-loaded

Every ISO 27001:2022 Annex A control ships seeded and themed (Organizational 37, People 8, Physical 14, Technological 34) with owner, status, and review-date tracking.

30 ISMS clause conformity tracker (4-10)

The mandatory management-system requirements are tracked separately from Annex A, each flagging the documented information it demands and a conformity status that cannot be marked Not Applicable.

Unified 5-framework control library

ISO 27001, ISO 27019, NIST CSF 2.0, SOC 2, and IEC 62443-2-1 catalogs live in one filterable library so a single control set spans multiple standards.

Cross-framework crosswalk & coverage matrix

Map any control to equivalent/related controls in other frameworks (96 seeded mappings) and see per-framework coverage percentages on the Frameworks page - test once, comply many.

IT-to-OT compliance bridge

66 seeded ISO 27001/27019 to IEC 62443-2-1 mappings connect your IT ISMS to the OT/ICS security program for energy and industrial environments.

5x5 risk register with heat map

Likelihood x impact scoring with inherent-vs-residual levels, treatment options (Mitigate/Accept/Transfer/Avoid), and a color-coded 5x5 heat map on the Analytics page.

Statement of Applicability

One applicable/not-applicable entry per Annex A control with justification, implementation status, and responsible owner, exportable for auditor review.

Maturity assessments & vendor questionnaires

Run CMMI-style control self-assessments (0-5 maturity) or Yes/No/Partial vendor questionnaires, one-click populated from any framework, with derived posture scores.

Objectives, KPIs/KRIs/KCIs with auto RAG

Define measurable security objectives (6.2) and indicators (9.1) that auto-derive On/Near/Off-Target RAG honoring whether higher or lower is better, charted against targets over time.

ISMS operational modules

Documented-information register (7.5), interested parties (4.2), suppliers/TPRM (5.19-5.23), incidents (5.24-5.28), awareness & training (7.2/7.3), audits, findings, policies, assets, and evidence.

Cross-cutting workflow & approvals

Any record can spawn tasks (Action/Approval/Review/Remediation) with a My-Tasks inbox, SLA/overdue flagging, and audit-tracked Approved/Rejected sign-off decisions.

Posture trend, reports & exports

A daily posture snapshot drives compliance/conformity/readiness/training trend charts, plus CSV exports (SoA, risks, controls) and a printable board-pack HTML for PDF.

IT-GRC Portal — ISO 27001:2022 — features diagram

03Architecture

A three-tier full-stack web app: a React 18 + TypeScript SPA talks over a versioned REST API (/api/v1) to an async FastAPI backend backed by PostgreSQL 16. On startup the app runs Alembic migrations and idempotently seeds all control catalogs, clauses, documents, sample data, and RBAC roles, so a fresh database becomes a working ISMS with no manual steps. Derived posture numbers flow through single-source-of-truth helpers and a daily snapshot table that grows the trend charts without a scheduler.

React SPA (frontend/src)

34 route pages (module lists + detail pages) plus Layout/StatusBadge components, an axios API client with a JWT interceptor, an auth context hook, and Recharts dashboards; built with Vite and Tailwind.

FastAPI route layer (backend/app/api)

22 route modules, one per domain (controls, clauses, risks, soa, assessments, tasks, analytics, suppliers, incidents, training, reports, reminders, ...), plus a shared deps.py, all mounted under /api/v1 with Swagger/ReDoc docs.

Domain & schema layer (models + schemas)

SQLAlchemy 2.0 async ORM models - 30 model classes across 21 modules - with UUID PKs and timezone-aware timestamps, paired with Pydantic v2 Create/Update/Read schemas; derived logic like compute_rag, task_is_overdue, and aggregate_score lives on the models.

Seed engine (seed/iso27001.py)

A ~1,300-line, SQLAlchemy-import-free data module holding all five framework catalogs, the crosswalk, ISMS clauses, mandatory documents, and sample records, seeded via per-framework idempotent gates.

Analytics & posture engine (api/analytics.py)

compute_headline() is the single source of truth for headline posture scores and record_posture_snapshot() upserts one row per day (triggered by the dashboard call) to build the posture-trend time series.

Data & migration layer

PostgreSQL 16 accessed via asyncpg, schema managed by Alembic with a baseline migration built from Base.metadata and autogenerate for changes; runs alembic upgrade head automatically on boot.

Auth & RBAC layer

JWT (python-jose) with bcrypt-hashed passwords (passlib) as the working auth path, optional SAML/OIDC config placeholders for a future IdP integration (blank settings + an auth_provider column; no SSO login flow implemented yet), and six default roles enforced through shared FastAPI dependencies (get_current_user, require_superuser).

IT-GRC Portal — ISO 27001:2022 — architecture diagram

04Project Structure

backend/app/api/22 FastAPI route modules (one per ISMS domain plus analytics, reports, reminders) alongside a shared deps.py; 24 files total in the directory.

backend/app/models/21 modules defining 30 SQLAlchemy async ORM model classes (Control, ClauseRequirement, Risk, Assessment, Task, PostureSnapshot, ...) with UUID PKs.

backend/app/schemas/Pydantic v2 request/response schemas (Create/Update/Read) mirroring each model.

backend/app/seed/iso27001.pySource-of-truth seed data: all 5 framework catalogs, 96 crosswalk mappings, 30 ISMS clauses, 17 documents, samples, and 6 RBAC roles.

backend/app/main.pyFastAPI app with a lifespan that runs Alembic migrations then seeds on first startup.

backend/alembic/Async migration environment with the 0001_baseline schema built from model metadata.

backend/tests/Five pytest modules (29 DB-free unit tests) covering RAG logic, 5x5 risk scoring, task-overdue, assessment scoring, and seed-data integrity.

frontend/src/pages/34 React route pages including Dashboard, Controls, Frameworks, Analytics, Assessments, and per-module detail pages.

docker-compose.ymlThree-container stack (PostgreSQL, FastAPI backend, React/nginx frontend) for one-command deployment.

.github/workflows/ci.ymlGitHub Actions CI with three jobs: backend compile+tests, Alembic up/down/check migrations, and frontend tsc+vite build.

CLAUDE.mdArchitecture and data-model reference documenting every module, framework, and seed count.

.env.exampleEnvironment template for SECRET_KEY, database URL, first superuser, and optional SAML/OIDC IdP settings.

05Security Controls

ISO 27001:2022 Annex A

All 93 controls pre-loaded and themed - Organizational (A.5.1-A.5.37, 37), People (A.6.1-A.6.8, 8), Physical (A.7.1-A.7.14, 14), Technological (A.8.1-A.8.34, 34).

ISMS clause conformity (4-10)

All 30 mandatory management-system requirements tracked for conformity across Context, Leadership, Planning, Support, Operation, Performance evaluation, and Improvement, each flagging its required documented information.

Documented information (Clause 7.5)

17 mandatory documents/records (Scope, IS Policy, SoA, risk treatment plan, objectives, audit and management-review records, corrective-action records, ...) as a controlled-document checklist with version, approval, and a document-readiness score.

Multi-framework crosswalk

148 catalog entries across ISO 27001 (93), ISO 27019 ENR (12), NIST CSF 2.0 (22), SOC 2 (13), and IEC 62443-2-1 (8), joined by 96 control-to-control mappings and a coverage matrix.

OT / energy-sector coverage

12 ISO/IEC 27019:2024 ENR controls for SCADA/ICS in energy utilities and an 8-element ISA/IEC 62443-2-1 OT program, bridged by 66 ISO/27019-to-62443 mappings.

Risk management

5x5 likelihood x impact risk register with inherent-vs-residual levels, treatment decisions (Mitigate/Accept/Transfer/Avoid), a heat map, and links to controls and assets.

Statement of Applicability

Per-control applicability with justification and implementation status (Not/Partially/Fully Implemented), exportable to CSV for auditors.

Assessments & maturity

CMMI-style control self-assessments (0-5 maturity), maturity assessments, and vendor security questionnaires with derived posture scores, one-click populated from any framework.

Supplier & incident governance

TPRM register (5.19-5.23) capturing IS-requirements-agreed, right-to-audit, PII processing, and certifications; incident register (5.24-5.28) with containment, root cause, lessons learned, and breach flagging.

Access control & audit trail

Six RBAC roles (CISO, GRC Manager, Risk Owner, Control Owner, Auditor, Viewer), bcrypt+JWT auth with optional SAML/OIDC config readiness, approval sign-off with decider/timestamp, and activity logging on all writes.

IT-GRC Portal — ISO 27001:2022 — controls diagram

06Technology Stack

Backend language: Python 3.12
Backend framework: FastAPI 0.115 + SQLAlchemy 2.0 (async) + Pydantic v2
Frontend: React 18 + TypeScript + Vite + Tailwind CSS + Recharts
Database: PostgreSQL 16 via asyncpg, Alembic migrations
Auth: JWT (python-jose) + bcrypt (passlib); SAML/OIDC config-ready (SSO flow not yet implemented)
Key dependencies: axios, react-router-dom, uvicorn, aiofiles, python-multipart
Testing: pytest - 29 DB-free unit tests (RAG, 5x5 risk, task-overdue, assessment scoring, seed integrity)
CI / Deployment: GitHub Actions (3 jobs) + Docker Compose (db, backend, frontend/nginx)

07Quick Start

$ cp .env.example .env  # then change SECRET_KEY and FIRST_SUPERUSER_PASSWORD
$ docker compose up --build -d  # auto-runs migrations and seeds all catalogs on first boot
$ Open the portal at http://localhost:3000 and the API docs at http://localhost:8000/docs
$ Log in with the admin credentials from .env (default admin@company.com / Admin@123 - change immediately)
$ Backend dev: cd backend && pip install -r requirements.txt && uvicorn app.main:app --reload --port 8000
$ Run tests: cd backend && pip install -r requirements-dev.txt && python -m pytest -q

08Compliance & Frameworks

ISO/IEC 27001:2022

Full Annex A (93 controls) plus all 30 Clause 4-10 management-system requirements.

ISO/IEC 27019:2024

12 energy-sector ENR controls for process control / SCADA / ICS environments.

NIST CSF 2.0

22 categories across the Govern, Identify, Protect, Detect, Respond, Recover functions.

SOC 2 (Trust Services Criteria)

13 criteria: Common Criteria CC1-CC9 plus Availability, Confidentiality, Processing Integrity, Privacy.

ISA/IEC 62443-2-1:2024

8 OT/IACS security program elements (ORG, CM, NET, COMP, DATA, USER, EVENT, AVAIL) with 66 ISO-to-62443 mappings.

ISO 27036-1 / ISACA guide

Supplier categorization (Product/Service/ICT/Cloud) and the ISACA Implementation Guide building blocks referenced across modules.

09Integrations & Outputs

Explore IT-GRC Portal — ISO 27001:2022

Full source, documentation, and deployment guides live on GitHub.

View on GitHub Browse all tools