Amane GRC — Continuous Compliance for Moroccan SMEs — Case Study

Why I built it

Kontrol, my other governance project, is built for enterprises: multi-tenant, PostgreSQL, signed decisions, cloud collectors. A twenty-person accounting firm in Casablanca needs the opposite. It has a Microsoft 365 tenant, a few Windows laptops, a register of personal data to keep for the CNDP, and, if it is an operator or a supplier of one, incidents to declare to the DGSSI. It has no security team and no budget for a SaaS priced in dollars per employee.

Amane is that bet: one company per installation, French throughout, two commands to start, and the Moroccan obligations treated as working tools rather than as a list of articles.

Law or standardUnified controlAutomated checkEvidenceScoreTrust Center

unified controls answering ISO 27001, Law 09-08 and the DNSSI at once

automated checks, recomputed on every change and every 15 minutes

end-to-end tests, run on Linux and Windows on every push

Amane overview: readiness per framework, failing checks, risks, open incidents and a priority list — The overview of the demonstration company: readiness per framework, what failed, and what to do first.

Implement once, score everywhere

The three Moroccan obligations overlap heavily. Encrypting laptops answers ISO 27001 A.8.1, the security obligation of Law 09-08 and the DNSSI rules on endpoints. Amane keeps one library of 66 controls, written in French, each mapped to every requirement it satisfies: progress on a control moves every framework that depends on it. NIST CSF 2.0 and COBIT 2019 can be switched on for clients who ask for them; eight COBIT objectives that have nothing to do with security start as excluded, with the reason written down.

Framework	Requirements	Coverage
ISO/IEC 27001:2022	Clauses 4 to 10 and the 93 Annex A controls	Every requirement mapped to at least one control
Law 09-08 (CNDP)	16 obligations, plus a register of processing activities with CNDP status	Every requirement mapped
DNSSI and Law 05-20	21 requirements, including incident declaration to the DGSSI	Every requirement mapped
NIST CSF 2.0 (optional)	22 categories	All mapped
COBIT 2019 (optional)	40 objectives	32 mapped, 8 excluded with a justification

The mapping is checked by the test suite: if a requirement of an enabled framework loses its last control, the build fails.

Evidence that is collected, not declared

Windows agent · 8 checks · no administrator rights

Every laptop, every four hours

A PowerShell agent, installed by each employee with one command from their own space, reports BitLocker, antivirus, firewall, updates, screen lock, Windows version, local administrator rights and the password policy. It needs no administrator rights and sends nothing but those results, the machine name and the user’s e-mail.

Microsoft Graph · read-only · 3 checks

MFA on every Microsoft 365 account

A read-only app registration reads the accounts, their registered authentication methods, the administrator roles, the security defaults and the Conditional Access policies. Three checks follow: MFA registered on every account, on every administrator, and enforced at tenant level. The client secret is encrypted with AES-256-GCM and never returned to the browser. Tenants without Entra ID P1/P2 are read account by account.

Microsoft 365 integration page listing accounts with their MFA methods and administrator roles — Seven accounts, four with MFA, one administrator without it: the test names the account.

Platform · 12 checks

The programme itself

Policies accepted by everyone at their current version, training under a year old, risks and critical suppliers reviewed, processing activities declared to the CNDP, incidents declared to the DGSSI, lessons written after serious incidents, access reviews closed and their removals actually done.

Moroccan obligations as working tools

Law 05-20 · DNSSI · Law 09-08

Incidents and the DGSSI declaration

Each incident gets a declaration deadline computed from its detection time, a pre-filled declaration sheet to print or save as PDF, and a flag when personal data is involved so that informing the CNDP is decided and recorded. The check stays red until the declaration date and reference are entered.

Incident register with a DGSSI declaration deadline and the CNDP status of each incident — One incident due for declaration within the internal deadline, two closed with their lessons.

ANSSI method · 5 workshops

EBIOS Risk Manager

Business values, supporting assets and feared events; risk sources and their objectives; stakeholders scored for threat; strategic and operational scenarios; then a gravity × likelihood map. A retained scenario goes to the risk register with its controls, and sending it again updates the same risk instead of creating a duplicate.

EBIOS RM workshop 5 with the risk map, a summary and the scenarios sent to the register — Workshop 5: three operational scenarios, two of them already followed in the risk register.

ISO 27001 A.5.18 · control IAM-05

Access reviews

A campaign freezes the list of Microsoft 365 accounts with their roles and MFA. Managers keep, modify or remove each access from their own space, and a correction cannot be recorded without saying what must change. Closing the campaign files the decisions as evidence on IAM-05; a second check stays red until every removal is confirmed as done.

Access review campaign with accounts, reviewers and keep, modify or remove decisions — A campaign in progress: four accounts reviewed out of seven, one administrator right to remove.

Showing it to clients without exposing it

Small companies lose deals on supplier security questionnaires. The Trust Center is a public page, updated continuously, that shows the readiness per framework, the controls in place, the checks passing and the subprocessors handling personal data. Policies are listed publicly; their full text opens only through a personal link valid thirty days, after an administrator approves the request.

Public Trust Center with readiness per framework and the security measures in place — The public page: only what is in place, never what is missing.

Integrity card of the activity log showing a verified HMAC chain and its current fingerprint — The activity log, chained and verified in one click.

An activity log an auditor can trust

Every action is sealed with an HMAC-SHA256 over its content and the fingerprint of the previous entry, keyed by the server’s secret. Editing, deleting or reordering an entry breaks the chain, and someone who copies the database without the key cannot rebuild it. SQLite triggers refuse updates and deletions, and the head of the chain is anchored every day and e-mailed to the administrators, so removing the latest entries is detected too. Seven tests play the attacker: content edited, fingerprint recomputed without the key, an entry deleted in the middle, the tail truncated. All are caught.

The interface

The first version looked like every generated dashboard: purple gradients, gradient rings, a waving hand. I rebuilt it around neutral surfaces, thin rules, one terracotta accent and the Geist typeface, embedded so that nothing loads from a CDN. It has a light and a dark theme, a command palette on Ctrl K that jumps to any page, control, policy or risk, and no front-end framework.

Amane overview in the dark theme — The dark theme.

Command palette searching for encryption and finding control END-01 — The command palette.

What building it taught me

My first Trust Center leaked the gaps. It listed every control with a tick or an empty circle, which is a map of where to attack. It now publishes only what is in place, and the server never sends the rest.
The agent lied on my own laptop. On a machine with Git installed, whoami resolved to Git’s version and the administrator check passed when it should not have. The agent now calls every Windows tool by its full System32 path.
Accents broke in PowerShell 5.1 until the server added a byte-order mark to the downloaded script. A test now reads the raw bytes, because fetch silently strips that mark when decoding text.
Tests changed how I build features. The access reviews were written with their nine tests before their interface, and the suite now catches a broken mapping, a leaked secret or a page that no longer parses before anything is pushed.

Limits

Nothing here was audited. Readiness scores are a structured self-assessment, not a prediction of a certification result.
Requirement texts are my own wording. ISO/IEC 27001 is copyrighted and the Moroccan texts are summarised for steering; the official texts remain the reference.
The DGSSI deadline is a setting. Law 05-20 requires declaration without delay; the number of hours is the organisation’s internal target, 24 by default.
The Microsoft 365 integration was tested against a simulated Graph API, with and without the P1/P2 report, not against a production tenant. E-mail alerts were tested against a local SMTP server.
One company per installation, a Windows-only agent, and no single sign-on yet.

The source is public under the MIT licence: github.com/omarbabba779xx/amane-grc. npm run demo builds the fictional company used in every screenshot.

Amane GRC — Continuous Compliance for Moroccan SMEs, from the Law to the Laptop