license, license_link, language, pipeline_tag, base_model, tags

license	license_link	language	pipeline_tag	base_model	tags
apache-2.0	https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct/blob/main/LICENSE	fr en	text-generation	Qwen/Qwen2.5-0.5B-Instruct	iso27001 cybersecurity isms compliance grc information-security audit fine-tuned qlora mlx gguf on-premise

🔐 ISO27001-Qwen2.5-0.5B-Edge

ISO 27001:2022 fine-tuned SLM — on-premise, offline, sovereign

---

About

A specialized AI agent for ISO/IEC 27001:2022 and ISO/IEC 27002:2022, designed to run entirely on-premise and offline — no data ever leaves your infrastructure.

Fine-tuned on 199 Q&A pairs covering the full ISO 27001:2022 requirements: clauses 4-10, all 93 Annex A controls, gap assessment, audit preparation, and regulatory alignment with NIS2, DORA, and GDPR.

---

Use Cases

• 🔍 ISMS Gap Assessment — maturity evaluation, non-conformity identification
• 📋 ISO 27001 Audit Support — clauses, Annex A controls, expected audit evidence
• 🛡️ CISO / DPO Advisory — risk management, risk treatment plan, Statement of Applicability
• 📄 Certification Preparation — auditor checklist, mandatory documentation
• 🔗 Regulatory Alignment — NIS2, DORA, GDPR, ISO 42001 mapped to ISO 27001

---

Quick Start

Ollama (recommended)

# Download the Modelfile
curl -O https://huggingface.co/sallani/ISO27001-Qwen2.5-0.5B-Edge/resolve/main/Modelfile

# Create and run
ollama create iso27001-agent -f Modelfile
ollama run iso27001-agent

llama.cpp

llama-cli \
  -m iso27001-qwen2.5-0.5b-q4_k_m.gguf \
  --chat-template qwen \
  -p "What are the mandatory documents required by ISO 27001:2022?" \
  -n 512

Python / transformers

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "sallani/ISO27001-Qwen2.5-0.5B-Edge"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id)

messages = [
    {
        "role": "system",
        "content": "You are an ISO 27001:2022 Lead Auditor and ISMS expert. Your answers are precise, actionable, and referenced to specific clauses and controls."
    },
    {
        "role": "user",
        "content": "What are the mandatory documents required by ISO 27001:2022?"
    }
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt")
outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.7)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))

MLX — Apple Silicon

pip install mlx-lm

python -m mlx_lm.generate \
  --model sallani/ISO27001-Qwen2.5-0.5B-Edge \
  --prompt "What is the Statement of Applicability in ISO 27001?" \
  --max-tokens 512

---

Available Files

File	Format	Size	Usage
model.safetensors	SafeTensors FP16	~988 MB	transformers, MLX
iso27001-qwen2.5-0.5b-q4_k_m.gguf	GGUF Q4_K_M	~398 MB	Ollama, llama.cpp
tokenizer.json	JSON	—	tokenization
config.json	JSON	—	architecture
Modelfile	Ollama	—	local deployment

---

Model Details

Parameter	Value
Architecture	Qwen2.5 Transformer decoder
Parameters	0.5B
Base model	Qwen/Qwen2.5-0.5B-Instruct
Fine-tuning method	QLoRA / LoRA via MLX-LM
LoRA layers	4
Learning rate	1e-4
Iterations	150
Batch size	8
Max sequence length	1,024 tokens
Max context	32,768 tokens
GGUF quantization	Q4_K_M (~398 MB)
Languages	French 🇫🇷 + English 🇬🇧

---

Training Dataset

Fine-tuned on sallani/iso27001-isms-dataset — 199 unique Q&A pairs (159 train / 40 test).

Coverage:

• Clauses 4-10 (all mandatory ISMS requirements)
• All 93 Annex A controls across 4 themes: Organisational, People, Physical, Technological
• All 11 new ISO 27001:2022 controls (threat intelligence, cloud security, secure coding, DLP, data masking…)
• Gap assessment methodology and ISMS maturity levels
• Practical scenarios: ransomware response, NIS2/DORA alignment, Zero Trust, AI/ISO 42001
• Bilingual FR/EN with Lead Auditor system prompt

---

Limitations

• 0.5B parameter model — reasoning capabilities are limited compared to larger models (>7B)
• Does not replace a professional ISO 27001 audit or a certified Lead Auditor
• Answers should be validated by an expert before use in a real audit context
• Knowledge is limited to the fine-tuning date

---

License

Apache 2.0 — same license as the base model Qwen2.5-0.5B-Instruct.

---

Citation

@model{iso27001_qwen25_edge_2025,
  title   = {ISO27001-Qwen2.5-0.5B-Edge},
  author  = {Sabri Allani},
  year    = {2025},
  url     = {https://huggingface.co/sallani/ISO27001-Qwen2.5-0.5B-Edge}
}