A Python CLI tool that automatically gathers technical control evidence from a Linux system and produces a tamper-evident, auditor-ready report mapped to ISO 27001:2022 Annex A controls.
Built by a certified ISO 27001 auditor with 35 years of enterprise IT experience, including infrastructure roles at Google DeepMind.
Running cec on a Linux system produces three output files:
| File | Description |
|---|---|
report.txt |
Human-readable summary mapped to Annex A control IDs |
evidence.json |
Machine-readable full findings for downstream tooling |
chain.jsonl |
Tamper-evident ledger proving evidence integrity |
Evidence is collected across six Annex A control areas:
| Control | Area |
|---|---|
| A.5.15 | Access control — user accounts |
| A.5.17 | Authentication information — password policy |
| A.8.2 | Privileged access rights — sudo rules |
| A.8.15 | Logging — failed login attempts |
| A.8.21 | Security of network services — open ports and running services |
| A.8.24 | Use of cryptography — disk encryption (LUKS / FileVault) |
Each piece of evidence is appended to a ledgerdemain chain as it is collected. The chain is verified at the end of every run and its status appears at the top of the report.
Chain : VALID ✓
If any evidence block is modified after collection, verification fails and the report flags it. This gives auditors a cryptographic chain of custody from collection to review.
Requires Python 3.10+.
git clone https://github.com/stetho/iso27001-cec.git
cd iso27001-cec
pip install -e .ledgerdemain is installed automatically as a dependency.
# Run with default timestamped output directory
cec
# Specify output directory
cec --output /path/to/evidenceOutput:
ISO 27001 Control Evidence Collector
Host : server01.example.com
Output : cec-output-20260729T120000Z
Chain initialised: cec-output-20260729T120000Z/chain.jsonl
Collecting: disk ... OK
Collecting: users ... OK
Collecting: auth ... OK
Collecting: network ... OK
Collecting: services ... OK
Chain verified ✓
Reports written:
cec-output-20260729T120000Z/evidence.json
cec-output-20260729T120000Z/report.txt
cec-output-20260729T120000Z/chain.jsonl
======================================================================
ISO 27001 CONTROL EVIDENCE REPORT
======================================================================
Host : server01.example.com
Collected : 2026-07-29T12:00:00+00:00
Tool : ISO 27001 Control Evidence Collector v0.1.0
Chain : VALID ✓
----------------------------------------------------------------------
[A.8.24] Use of cryptography
Encrypted devices : 2/3
✓ sda2 (/)
✓ sdb1 (/data)
----------------------------------------------------------------------
[A.5.15] Access control
Human accounts : 3
System accounts : 41
Root account : root (shell: /bin/bash)
• alice (uid=1000, shell=/bin/bash)
• bob (uid=1001, shell=/bin/bash) [LOCKED]
• deploy (uid=1002, shell=/bin/bash)
----------------------------------------------------------------------
[A.8.2] Privileged access rights
alice ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL
----------------------------------------------------------------------
[A.5.17] Authentication information
Max days : 90
Min days : 1
Min length : 12
Warn age : 7
Encrypt method : SHA512
----------------------------------------------------------------------
[A.8.15] Logging
Recent failures from log (8):
Jul 29 11:43:02 server01 sshd: Failed password for invalid user...
----------------------------------------------------------------------
[A.8.21] Security of network services — Network Ports
Total listening : 4 (via ss)
Notable ports:
• 22/tcp (SSH) on 0.0.0.0
• 80/tcp (HTTP) on 0.0.0.0
----------------------------------------------------------------------
[A.8.21] Security of network services — Running Services
Total running : 24
• ssh.service — OpenBSD Secure Shell server
• nginx.service — A high performance web server
• docker.service — Docker Application Container Engine
...
======================================================================
END OF REPORT
======================================================================
| Feature | Linux | macOS |
|---|---|---|
| Disk encryption | LUKS via lsblk + cryptsetup |
FileVault via fdesetup |
| User accounts | /etc/passwd + /etc/shadow |
/etc/passwd (partial) |
| Password policy | /etc/login.defs + PAM |
Not available |
| Failed logins | /var/log/auth.log + lastb |
Not available |
| Open ports | ss |
lsof |
| Running services | systemd / systemctl |
Not available |
The tool is designed for Linux servers. macOS support is included for development and testing; production use is on Linux.
Adding a new control is three steps:
- Add a collector function in
cec/collectors/ - Add the Annex A mapping in
cec/controls.py - Register the collector in
cec/cli.py
The chain and reports pick up new controls automatically.
pip install pytest
pytest tests/ -v21 tests covering all five collectors, structural validation, and graceful degradation across platforms.
This tool uses ledgerdemain as a library dependency. ledgerdemain is a standalone tamper-evident evidence chain tool — it can be used independently of the CEC for any workflow requiring a verifiable audit trail.