Deming is open-source software for managing, planning, tracking and reporting on the effectiveness of security controls within an information security management system (ISMS). According to its developer it follows ISO 27004 and supports ISO 27001, NIS2 and DORA, among other frameworks. You add further frameworks by importing a structured spreadsheet. Deming provides a central list of controls, a planning calendar, action plans, dashboards and reports. It is built with PHP and Laravel, works with MariaDB, MySQL, PostgreSQL or SQLite, and is installed with Docker or manually.
Deming is maintained by Sourcentis, a limited-liability company in Luxembourg that also offers professional support and custom development. The source code is on GitHub under the GPL-3.0 licence. Sourcentis states that it provides no cloud service for Deming: you run the software on your own infrastructure, so your controls and evidence are not sent to the developer. That suits organisations that want to keep ISMS data within Europe without an external SaaS provider. The project appears in French public-sector free-software catalogues.