---
license: apache-2.0
license_link: https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct/blob/main/LICENSE
language:
- fr
- en
pipeline_tag: text-generation
base_model: Qwen/Qwen2.5-0.5B-Instruct
tags:
- iso27001
- cybersecurity
- isms
- compliance
- grc
- information-security
- audit
- fine-tuned
- qlora
- mlx
- gguf
- on-premise
---

<div align="center">

# 🔐 ISO27001-Qwen2.5-0.5B-Edge

**ISO 27001:2022 fine-tuned SLM — on-premise, offline, sovereign**

[![Base Model](https://img.shields.io/badge/base-Qwen2.5--0.5B--Instruct-orange?style=flat-square)](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct)
[![License](https://img.shields.io/badge/license-Apache%202.0-green?style=flat-square)](LICENSE)
[![Lang](https://img.shields.io/badge/lang-FR%20%7C%20EN-blue?style=flat-square)]()
[![GGUF](https://img.shields.io/badge/GGUF-Q4__K__M-purple?style=flat-square)]()

</div>

---

## About

A specialized AI agent for **ISO/IEC 27001:2022** and **ISO/IEC 27002:2022**, designed to run entirely **on-premise and offline** — no data ever leaves your infrastructure.

Fine-tuned on 199 Q&A pairs covering the full ISO 27001:2022 requirements: clauses 4-10, all 93 Annex A controls, gap assessment, audit preparation, and regulatory alignment with NIS2, DORA, and GDPR.

---

## Use Cases

- 🔍 **ISMS Gap Assessment** — maturity evaluation, non-conformity identification
- 📋 **ISO 27001 Audit Support** — clauses, Annex A controls, expected audit evidence
- 🛡️ **CISO / DPO Advisory** — risk management, risk treatment plan, Statement of Applicability
- 📄 **Certification Preparation** — auditor checklist, mandatory documentation
- 🔗 **Regulatory Alignment** — NIS2, DORA, GDPR, ISO 42001 mapped to ISO 27001

---

## Quick Start

### Ollama (recommended)

```bash
# Download the Modelfile
curl -O https://huggingface.co/sallani/ISO27001-Qwen2.5-0.5B-Edge/resolve/main/Modelfile

# Create and run
ollama create iso27001-agent -f Modelfile
ollama run iso27001-agent
```

### llama.cpp

```bash
llama-cli \
  -m iso27001-qwen2.5-0.5b-q4_k_m.gguf \
  --chat-template qwen \
  -p "What are the mandatory documents required by ISO 27001:2022?" \
  -n 512
```

### Python / transformers

```python
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "sallani/ISO27001-Qwen2.5-0.5B-Edge"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id)

messages = [
    {
        "role": "system",
        "content": "You are an ISO 27001:2022 Lead Auditor and ISMS expert. Your answers are precise, actionable, and referenced to specific clauses and controls."
    },
    {
        "role": "user",
        "content": "What are the mandatory documents required by ISO 27001:2022?"
    }
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt")
outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.7)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))
```

### MLX — Apple Silicon

```bash
pip install mlx-lm

python -m mlx_lm.generate \
  --model sallani/ISO27001-Qwen2.5-0.5B-Edge \
  --prompt "What is the Statement of Applicability in ISO 27001?" \
  --max-tokens 512
```

---

## Available Files

| File | Format | Size | Usage |
|------|--------|------|-------|
| `model.safetensors` | SafeTensors FP16 | ~988 MB | transformers, MLX |
| `iso27001-qwen2.5-0.5b-q4_k_m.gguf` | GGUF Q4_K_M | ~398 MB | Ollama, llama.cpp |
| `tokenizer.json` | JSON | — | tokenization |
| `config.json` | JSON | — | architecture |
| `Modelfile` | Ollama | — | local deployment |

---

## Model Details

| Parameter | Value |
|-----------|-------|
| Architecture | Qwen2.5 Transformer decoder |
| Parameters | 0.5B |
| Base model | `Qwen/Qwen2.5-0.5B-Instruct` |
| Fine-tuning method | QLoRA / LoRA via MLX-LM |
| LoRA layers | 4 |
| Learning rate | 1e-4 |
| Iterations | 150 |
| Batch size | 8 |
| Max sequence length | 1,024 tokens |
| Max context | 32,768 tokens |
| GGUF quantization | Q4_K_M (~398 MB) |
| Languages | French 🇫🇷 + English 🇬🇧 |

---

## Training Dataset

Fine-tuned on **[sallani/iso27001-isms-dataset](https://huggingface.co/datasets/sallani/iso27001-isms-dataset)** — 199 unique Q&A pairs (159 train / 40 test).

Coverage:
- Clauses 4-10 (all mandatory ISMS requirements)
- All 93 Annex A controls across 4 themes: Organisational, People, Physical, Technological
- All 11 new ISO 27001:2022 controls (threat intelligence, cloud security, secure coding, DLP, data masking…)
- Gap assessment methodology and ISMS maturity levels
- Practical scenarios: ransomware response, NIS2/DORA alignment, Zero Trust, AI/ISO 42001
- Bilingual FR/EN with Lead Auditor system prompt

---

## Limitations

- **0.5B parameter model** — reasoning capabilities are limited compared to larger models (>7B)
- **Does not replace** a professional ISO 27001 audit or a certified Lead Auditor
- Answers should be **validated by an expert** before use in a real audit context
- Knowledge is limited to the fine-tuning date

---

## License

Apache 2.0 — same license as the base model [Qwen2.5-0.5B-Instruct](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct/blob/main/LICENSE).

---

## Citation

```bibtex
@model{iso27001_qwen25_edge_2025,
  title   = {ISO27001-Qwen2.5-0.5B-Edge},
  author  = {Sabri Allani},
  year    = {2025},
  url     = {https://huggingface.co/sallani/ISO27001-Qwen2.5-0.5B-Edge}
}
```