3. Information Security Management System (ISMS)
3.1 ISMS Scope Definition
The Information Security Management System (ISMS) covers the organisational processes, technical infrastructure, and information assets required for the development, operation, and delivery of OpenRemote software and services. The scope includes product development, project realisation, hosting and maintenance services, internal operational tools, and associated data processing activities.
The ISMS applies to all employees, contractors, and contributors involved in the operation of OpenRemote services and development activities. The scope also includes cloud infrastructure, code repositories, development environments, and collaboration platforms used to support these activities.
3.2 Document Control and Record Management
OpenRemote maintains controlled documentation to ensure that policies, procedures, and operational records remain accurate, traceable, and up to date. Documents related to the quality and security management system are version controlled and publicly published or stored in secure repositories when access should be restricted to authorised personnel (see section 16).
Changes to policies and procedures are reviewed and approved by the relevant process owners before publication. Historical versions are archived to maintain traceability and support audit requirements. Records generated during operational activities, such as meeting reports, incident reports, and audit results, are retained according to defined retention policies.
3.3 Evidence Register
The evidence register for tools and services provides a structured overview of documentation and system records that demonstrate the implementation of organisational processes and security controls (see section 16). Evidence may include monitoring logs, development records, meeting minutes, incident reports, and system configuration documentation.
The register links each key control or process to the relevant source of evidence and identifies the responsible owner for maintaining that information . This approach ensures transparency and facilitates internal reviews and external audits.
3.4 Control Mapping (ISO27001 – NIS2 – CRA)
OpenRemote maintains a mapping between its internal processes and the security requirements defined in ISO27001, the NIS2 Directive, and the Cyber Resilience Act. This mapping ensures that implemented controls can be traced to the relevant regulatory requirements (see Annex A).
The mapping allows the organisation to demonstrate compliance and identify areas where additional controls may be required. The detailed control mapping is maintained in the annex of this handbook and is periodically reviewed as regulations or standards evolve.