# DM ISO27k v1.0 Manual

DarkMind ISO 27001 Workspace

Version: 1.0

Website: https://darkmind.uk/iso27k/

Serials: https://darkmind.uk/isoSerial/

Support: tompdjohnson@outlook.com

---

## 1. What DM ISO27k Is

DM ISO27k is a local-first ISO 27001 workspace for organisations preparing an information security management system.

It helps a business record the information needed for ISO 27001 readiness, including:

- Business details
- Asset register
- Supplier register
- Risk register
- Statement of Applicability support
- Security concerns and incident-style records
- Evidence tracking
- Internal audit planning
- Corrective actions
- Policy generation
- Checklist generation
- Word document pack export
- Complete workspace export
- Optional local AI support through Qwen and Ollama

DM ISO27k is not a certification body, legal adviser, auditor, or guarantee of certification. It is a practical workspace that helps organise the work, produce draft documents, and maintain useful ISO 27001 records.

---

## 2. Important Privacy Position

DM ISO27k is designed as a local-first tool.

Your company details, risks, assets, evidence, generated policies, registers, and exports are stored on the local computer.

If local AI is enabled, Qwen runs locally through Ollama. No company information is sent to online AI services by the Qwen workflow.

The licensing server only needs licence and device activation data. It does not need company ISO data, policy text, risks, evidence, prompts, supplier records, or business records.

---

## 3. Evaluation And Licensing

DM ISO27k v1.0 includes a 180 day free evaluation period.

During the evaluation period, the full workspace can be used.

After the evaluation period ends, the app enters read-only mode unless a valid serial is activated.

In read-only mode, users can still:

- View company records
- View generated documents
- View risks, assets, suppliers, evidence, audits, concerns, and actions
- Export Markdown
- Export Word packs
- Export all local data
- Download existing exports
- Enter and activate a licence serial

In read-only mode, users cannot:

- Add or edit records
- Delete records
- Generate new policies or registers
- Use AI assistance
- Recalculate readiness
- Reset the workspace

Paid serials are valid for 12 months.

Current serial price: GBP 49.99 per year.

Purchase page:

https://darkmind.uk/isoSerial/

---

## 4. System Requirements

Minimum practical requirements:

- Windows 10 or Windows 11
- Internet connection for licence activation and optional Ollama download
- Enough disk space for the app, database, generated documents, and evidence files
- Modern browser installed, because the app opens its interface in a browser window

Optional AI requirements:

- Ollama installed
- Qwen model installed
- A GPU broadly equivalent to an NVIDIA RTX 2080 Ti or better is recommended for local AI support

The app can run without AI. If AI is disabled or unavailable, the core ISO workspace remains usable.

---

## 5. Installing DM ISO27k

Run the installer or EXE supplied with the package.

The current download file is:

DM-ISO27k-v1.0.exe

When started, the app runs locally and opens the user interface in a browser at:

http://127.0.0.1:8017/

The app is intended for local desktop use.

Do not expose the local app to the public internet.

---

## 6. First Start

On first start, DM ISO27k creates local runtime files for the workspace.

These may include:

- Local SQLite database
- Licence state file
- Exports folder
- Evidence files folder

The app may ask whether the computer has a suitable GPU for local AI.

If the user says yes, the app can attempt to install or use Ollama and the Qwen model.

If the user says no, the app continues without AI.

---

## 7. Main Workflow

The recommended workflow is:

1. Enter business details
2. Record assets and suppliers
3. Create risks and treatment notes
4. Build Statement of Applicability support
5. Log security concerns
6. Track evidence
7. Plan internal audits
8. Record corrective actions
9. Generate policies and registers
10. Export the document pack
11. Review readiness

The app is built so company details act as the source of truth. Policies and generated documents should reflect the business details entered by the user.

---

## 8. Business Details

The Business Details area should be completed first.

Typical information includes:

- Company name
- Industry
- Business type
- Number of staff
- Locations
- Remote work details
- Main services
- Critical business processes
- Customer types
- Key suppliers
- Cloud systems
- Identity provider
- Endpoint management
- Backup solution
- Data types processed
- Compliance drivers
- Current security maturity
- Certification goal
- Target certification date

Good business details improve the quality of generated policies, risks, registers, and implementation plans.

---

## 9. Asset Register

The asset register records systems, devices, data repositories, cloud services, applications, and key information assets.

Useful asset fields include:

- Asset name
- Asset type
- Owner
- Location
- Data classification
- Criticality
- Supplier
- Backup notes
- General notes

Examples:

- Microsoft 365 tenant
- Accounting system
- CRM
- Staff laptops
- Customer database
- Website
- File storage platform
- Identity provider
- Firewall
- Backup service

Assets should be linked to risks where possible.

---

## 10. Supplier Register

The supplier register tracks third parties that provide services or have access to company data.

Useful supplier fields include:

- Supplier name
- Service provided
- Internal owner
- Data access
- Criticality
- Contract status
- Review frequency
- Assurance notes
- Status

Supplier records help support ISO 27001 controls around supplier relationships, service delivery, cloud services, and external dependencies.

---

## 11. Risk Register

The risk register records realistic information security risks.

Useful risk fields include:

- Asset or process
- Risk scenario
- Threat
- Vulnerability
- Impact
- Likelihood
- Inherent risk
- Treatment
- Owner
- Evidence required
- Status

Example risk:

Risk scenario: Compromised Microsoft 365 administrator account exposes customer data.

Threat: Credential phishing.

Vulnerability: Privileged access targeted by attackers.

Impact: Customer data exposure and operational disruption.

Treatment: MFA, privileged access reviews, conditional access, admin separation, monitoring.

Evidence: MFA report, admin list, access review, alert review record.

---

## 12. Risk Assistance With Qwen

If local AI is enabled, Qwen can help draft risk details.

The user can enter the risk or concern, then ask Qwen to suggest:

- Threat
- Vulnerability
- Impact
- Likelihood
- Treatment
- Evidence required
- Improvement actions

AI output should be reviewed by a human before saving.

If AI is unavailable, the user can still complete the fields manually.

---

## 13. Security Concerns

The Security Concerns area is for logging issues such as:

- Phishing attempts
- Suspected breaches
- Malware
- Attack attempts
- Supplier security concerns
- Lost devices
- Suspicious logins
- Data leakage concerns
- Near misses

Useful fields include:

- Title
- Concern type
- Reporter
- Detected date
- Affected asset
- Severity
- Status
- Description
- Impact observed
- Immediate actions
- Qwen suggestions

This area helps turn incidents and concerns into improvement actions, risks, evidence, and management review topics.

---

## 14. Evidence Tracking

Evidence tracking helps the user record what proof exists for the ISMS.

Examples of useful evidence:

- Access review records
- Backup test records
- Supplier reviews
- Policy approvals
- Awareness training records
- Vulnerability scan results
- Patch records
- Incident logs
- Security concern reviews
- Internal audit notes
- Management review minutes
- Corrective action closure evidence

Evidence fields include:

- Title
- Evidence type
- Related area
- Owner
- Location
- Frequency
- Status
- Notes

Evidence files can be attached where supported.

---

## 15. Internal Audits

The Internal Audit area helps plan and record audit activity.

Useful fields include:

- Audit title
- Scope
- Auditor
- Planned date
- Status
- Summary
- Findings
- Evidence reviewed

Internal audits should check whether the organisation is doing what its own policies and processes say it does.

Audit results should feed into corrective actions and management review.

---

## 16. Corrective Actions

Corrective actions track improvements and fixes.

Useful fields include:

- Title
- Source
- Owner
- Priority
- Due date
- Status
- Root cause
- Action plan
- Closure evidence
- Effectiveness check

Sources may include:

- Internal audit
- Security concern
- Risk assessment
- Supplier review
- Customer feedback
- Management review
- Certification audit

---

## 17. Policies And Documents

DM ISO27k can generate:

- Implementation plans
- Full policies
- Registers
- Checklists
- Staff-facing policy text
- Document packs

Generated policies should be reviewed, edited, approved, and adapted to the real business before use.

Policies should be generic enough to work for many organisations but tailored with the business details entered by the user.

Examples of policies may include:

- Information Security Policy
- Access Control Policy
- Acceptable Use Policy
- Incident Response Policy
- Supplier Security Policy
- Backup Policy
- Asset Management Policy
- Remote Working Policy
- Data Handling Policy
- Password and Authentication Policy

---

## 18. Policy Library

The Policy Library tracks:

- Completed policies
- Policies waiting to be completed
- Staff-facing policies
- Manually added policy drafts

Users can:

- Click a policy to read it
- Delete individual policies
- Add or edit policy content before saving
- Generate missing policies

---

## 19. Checklists

The checklist area contains useful ISO implementation checklists.

Examples:

- Certification Readiness Checklist
- Evidence Checklist
- Internal Audit Preparation Checklist
- 30/60/90 Implementation Checklist
- Security Concern Response Checklist
- Supplier Assurance Checklist
- Risk Assessment Quality Checklist
- Staff Security Checklist

Checklists should support planning and improvement, not replace professional judgement.

---

## 20. Readiness

The readiness view helps show whether the workspace has enough records for a credible ISO preparation route.

Readiness can consider:

- Business details
- Assets
- Suppliers
- Risks
- Evidence
- Security concerns
- Internal audits
- Corrective actions
- Generated documents

Readiness is a guide only. It is not a certification result.

---

## 21. Exporting Data

DM ISO27k supports several export routes.

Markdown export:

- Exports generated outputs into a Markdown pack.

Word pack export:

- Creates editable Word documents and packages them into a ZIP.

Complete workspace export:

- Exports local records, generated documents, and evidence files into a full ZIP.

Exports remain available even after the evaluation period or licence expires.

This is intentional so users are never locked out of their own data.

---

## 22. Local AI Settings

AI can be turned on or off in Settings.

If AI is off:

- The app remains usable
- Manual record creation still works
- Policy and register generation may use built-in templates and local logic
- AI-assisted suggestions will not be available

If AI is on:

- The app attempts to use Qwen through Ollama
- Prompts stay local to the Ollama/Qwen workflow
- A suitable GPU is recommended

---

## 23. Ollama And Qwen

Ollama is used to run local AI models.

Qwen is the local model configured for AI assistance.

If Qwen is not available, the app can still be used without AI.

If Qwen is enabled but not working, check:

- Ollama is installed
- Ollama service is running
- Qwen model is downloaded
- The computer has enough resources
- AI is enabled in Settings

---

## 24. Licensing Server Notes

The app is configured to use:

https://darkmind.uk/licensing

The purchase page is:

https://darkmind.uk/isoSerial

The download page is:

https://darkmind.uk/iso27k

The licensing backend should provide:

- POST /licensing/api/licence/activate
- POST /licensing/api/licence/validate

The licensing backend should only receive licence key, device fingerprint, device name, and app version data.

---

## 25. Website Payment Flow

The website payment flow is:

1. Customer visits https://darkmind.uk/isoSerial
2. Customer pays GBP 49.99 through PayPal
3. PayPal sends IPN notification to /licensing/paypal-ipn.php
4. The server verifies the IPN with PayPal
5. The server checks:
   - Payment is completed
   - Receiver email is correct
   - Currency is GBP
   - Amount is 49.99
   - Product code matches
6. The server claims a serial from the serial pool
7. The serial is emailed to the PayPal payer email
8. The customer enters the serial in DM ISO27k
9. The app activates the licence

---

## 26. Serial Pool

The licensing database includes a prepared serial pool.

Current pool size:

- 5,000 available serials

Each serial is valid for 12 months once issued.

If email delivery fails, the serial is still stored in the licensing database against the PayPal transaction ID so it can be recovered and sent manually.

---

## 27. IONOS Email Setup

The licensing backend is prepared for IONOS SMTP.

Typical IONOS UK SMTP settings:

- Host: smtp.ionos.co.uk
- Port: 587
- Security: STARTTLS

Before upload, edit:

licensing/config.php

Set:

- SMTP username
- SMTP password
- From email
- Support email
- Licence hash pepper

After upload, test:

https://darkmind.uk/licensing/test-email.php?to=YOUR_EMAIL

After email works, delete test-email.php from the live server.

---

## 28. Uploading The Website Files

Upload these website folders and files:

- /iso27k/
- /isoSerial/
- /downloads/DM-ISO27k-v1.0.exe
- /licensing/

The installer should be placed on the webserver at:

/downloads/DM-ISO27k-v1.0.exe

The download page should be placed at:

/iso27k/

The serial purchase page should be placed at:

/isoSerial/

The licensing backend should be placed at:

/licensing/

---

## 29. Troubleshooting

### The app does not open

Check:

- Windows has not blocked the EXE
- Antivirus has not quarantined the file
- Port 8017 is not already in use
- Try running again as a local user

### Browser does not open

Open manually:

http://127.0.0.1:8017/

### AI does not work

Check:

- AI is enabled in Settings
- Ollama is installed
- Ollama is running
- Qwen model is installed
- GPU resources are sufficient

The app can still be used without AI.

### Serial does not activate

Check:

- Internet connection
- Serial was entered exactly
- Licensing server is online
- Serial has not expired
- PayPal payment completed

### Serial email does not arrive

Check:

- Spam folder
- PayPal payer email address
- IONOS SMTP settings
- licensing/paypal-ipn.log
- licensing.sqlite for the PayPal transaction ID

### Export does not download

Check:

- Generated documents exist
- Exports folder is writable
- Browser download was not blocked

---

## 30. Security Notes

Do not ship:

- .venv/
- Local development databases
- Source build folders
- Temporary exports
- Test evidence files
- Development-only zips

For public download, ship:

- The compiled EXE
- Manual
- Installer wrapper if using Inno Setup

Keep private:

- licensing.sqlite backups
- LICENCE_HASH_PEPPER
- IONOS SMTP password
- PayPal account credentials
- IPN logs

---

## 31. Suggested User Quick Start

1. Install DM ISO27k.
2. Open the app.
3. Complete Business Details.
4. Add key assets.
5. Add key suppliers.
6. Create the first risks.
7. Add evidence items.
8. Generate initial policies.
9. Export a Word pack.
10. Review readiness.

---

## 32. Disclaimer

DM ISO27k supports ISO 27001 preparation and information security management work.

It does not guarantee ISO certification.

Generated documents must be reviewed, edited, approved, and used appropriately by the organisation.

For formal certification, engage an accredited certification body and qualified professional advice where needed.
