Is SOMAP good for risk assessment or it is not in use any more?
Is there any other Open Source IT Risk Management?
After skimming the documents, I cannot recommend SOMAP as a guide for risk. I have not reviewed the software, but the guidance on risk in the documents is too cursory to be useful. Also note that the guides for SOMAP have not been updated since their original version published in 2006.
There are lots of IT Risk methodology options for you to look at in varying degrees of complexity, focus, and in availability (free/paid):