Skip to content
    AccountStart free
    ISMS as Code · annual contract

    The management system as a repository.

    Your agent interviews for state and evidence and keeps the bookkeeping. Your people approve every change. The merge history is the audit trail. ISO 27001 or NIST-keyed, in the git you already run.

    Ask about a pilotPricing
    controls/A.5.26 response to incidents: evidence added, owner namedpasses
    gaps/GAP-018 closed, linked to the incident drill of 2026-09-04passes
    reviewSecond-model review: no standard text in the diffpasses
    approvalResponsible person: CISO, requiredwaiting

    Illustrative example

    Why a repository

    Engineering-led companies keep everything else in git. Now the management system too.

    Document kits are a commodity and SaaS GRC keeps your evidence in its database. A repository gives you review, history and ownership for free, and lets your own agent do the interviewing.

    What is in it

    Controls, gaps, decisions and the interview plan, one file each, with the responsible person named on every control. No standard text is ever stored: the standard is read through the licensed add-on, never copied.

    docs/controls/One file per control: statement, owner, evidence plan, statusreviewed
    docs/gaps/GAP register, each gap linked to its control and its planreviewed
    docs/decisions/Management decision records, dated, with the evidence citedreviewed
    plan/The agent's interview plan: what to ask whom, and whenrunning
    CODEOWNERSThe responsible person approves every change on the exact commitenforced

    How a change lands

    The agent proposes in a pull request. A second model reviews it for standard text and consistency. The responsible person approves on the exact commit, enforced by the repository, and the merge is the record.

    controls/A.5.26 response to incidents: evidence added, owner namedpasses
    gaps/GAP-018 closed, linked to the incident drill of 2026-09-04passes
    reviewSecond-model review: no standard text in the diffpasses
    approvalResponsible person: CISO, requiredwaiting

    Illustrative example

    The proof

    We run our own on it.

    Ansvar's ISO 27001 management system is this repository, operated by our own agent sessions. BSI assessed it at Stage 1 on 31 August 2026 and recorded one minor finding. Stage 2 is scheduled for October 2026.

    Stage 1 is an assessment, not a certificate. We will say so plainly until the certificate is issued.
    How the pilot runs

    Ten weeks, €6,000, credited when you convert.

    1. Install

      The template repository lands in your GitHub with the approval rules on. You buy the standard through the add-on for the people who read it.

    2. First interview wave

      Your agent asks the owners for state and evidence, control by control, and records what it learns as pull requests.

    3. First gap register

      Gaps land with owners and plans. The register is a merge, not a spreadsheet.

    4. Decide

      Convert to the annual contract and the pilot fee is credited in full. Up to four delivery days from us are inside the pilot.

    ISO 27001 or NIST-keyed

    €9,000 a year, workspace included. Content pack, agent plan, quarterly pack updates, second-model review recipe, statement-of-applicability importer.

    With maintained mappings

    €12,000 a year. The reviewed ISO to 800-53 edge set and operation across both keys, maintained as the standards move.

    Put the management system where the work is.

    A paid pilot, fixed in scope, credited on conversion.

    Ask about a pilotSee the four products