Deming

Search for Deming in Marketplace, select the SecureAnyCloud publisher, and click Create. Choose Standard_B2s or larger.

Configure the Network Security Group to allow TCP 80 for the application from your own networks, and TCP 22 for administration from your administrative networks only. The database and the PHP runtime stay on loopback and are never exposed.

Run these commands to create the resource group, accept the Marketplace terms, create the VM and open ports 80 and 22:

RG="deming-prod"; LOCATION="eastus"; VM_NAME="deming" IMAGE_URN="sac1647283583153:deming-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:deming-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot the image generates this VM's application key, database password and administrator password, and creates the database schema. It imports the ISO 27001:2022 controls and demonstration data, rotates the seeded administrator to your per-instance password, and scrambles the demo accounts. It then opens the bootstrap gate, starts the web server, verifies that the new credentials work and the defaults are rejected, and writes /root/deming-credentials.txt.

First boot completes within a minute or two. SSH in as azureuser and read the details:

sudo cat /root/deming-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the instance URL, the administrator login and password, and the database name, user and password.

Confirm that all three services report active. The ss output shows the application on port 80 while MariaDB is bound to loopback only, and the response headers carry no server version banner.

systemctl is-active mariadb.service php8.4-fpm.service nginx.service php -r 'echo "PHP ".PHP_VERSION."\n";' mysql --version nginx -v ss -tlnp | grep -E ':(80|3306) ' | sed 's/users:.*//' | sort curl -sI http://127.0.0.1/login | head -4

Browse to http://<your-vm-public-ip>/. You are redirected to the sign-in page. Enter the login admin@admin.localhost and the password from the credentials file.

You can prove the same sign-in from the command line. This command uses the per-instance password from the credentials file to complete a real login through the form, then checks that the seeded default and other common passwords are refused:

sudo /usr/local/sbin/deming-login-check.sh admin@admin.localhost '<DEMING_ADMIN_PASSWORD>' && echo "per-VM password: ACCEPTED (correct)"
sudo /usr/local/sbin/deming-login-check.sh admin@admin.localhost 'admin' || echo "admin@admin.localhost/admin: REJECTED (correct)"
sudo /usr/local/sbin/deming-login-check.sh admin@admin.localhost '' || echo "blank password: REJECTED (correct)"

After you sign in, you land on the dashboard. The left navigation holds the whole ISMS model: Controls, Measurements, Planning, Action plans, Risks, the Risk matrix, Exceptions, Analysis, Reports and Configuration.

The main panel summarises your programme: the count of domains, controls, measurements, action plans, risks and exceptions, a schedule of upcoming measures, and the status of your measurements. All of it is populated from the ISO 27001:2022 set and the demonstration data that first boot generated.

Set your own password as soon as you have signed in. Open the user menu in the top right and choose your Profile, then use the change password form. Enter the per-instance password from the credentials file as the current password, and choose a new one.

Deming stores passwords as bcrypt hashes, so the new password is never recoverable from the database. After you change it, the copy in /root/deming-credentials.txt is stale. Keep the file for the database password, or remove the administrator password line from it.

Open Controls from the left navigation. Deming lists the ISO 27001:2022 control catalogue that first boot imported, grouped by domain and clause, with the number of measurements recorded against each. From here you can open a control, plan a measurement, and record how your organisation implements it.

Deming ships several other frameworks ready to load: ISO 27001:2013, ISO 22301, DORA, NIS2, PCI DSS 4.0 and NIST 800-53. Import one from Configuration → Import, or from the command line:

sudo -u www-data php /var/www/deming/artisan deming:import-framework \
  /var/www/deming/storage/app/repository/NIS2.en.xlsx

Open Risks to see the risk register, and Risk matrix for the likelihood-by-impact heat map. The demonstration data seeds a set of scored risks across the matrix, with a breakdown by risk level and by treatment status. You can see how Deming presents risk before you record your own.

To add a risk, use the add button, score its probability and impact, and choose a treatment. The risk then takes its place on the matrix.

The instance ships with demonstration security measures, risks and action plans, so every view is populated for evaluation. When you are ready to run your own programme, clear the demonstration data and start from the ISO 27001:2022 controls alone. This drops all data and re-imports the framework, so take a backup first (Step 16):

cd /var/www/deming
sudo -u www-data env LANG=en php artisan migrate:fresh --seed sudo -u www-data php artisan db:seed --class=AttributeSeeder sudo -u www-data env LANG=en php artisan deming:import-framework \
  storage/app/repository/ISO27001-2022.en.xlsx --clean

migrate:fresh recreates the administrator from the seeder. Afterwards, sign in with admin@admin.localhost / admin once, and immediately change the password from your Profile.

A fresh instance has no working mail transport, so notification and password reset email is not delivered until you configure one. Edit the MAIL_ values in /var/www/deming/.env (MAIL_HOST, MAIL_PORT, MAIL_USERNAME and MAIL_PASSWORD) to point at your SMTP server. Then clear the cached configuration:

sudo -u www-data php /var/www/deming/artisan config:clear

Keep the file's ownership and permissions as they are. The file is root:www-data mode 0640 on purpose, because it holds this VM's application key and database password.

Deming can authenticate against your own directory. LDAP and Keycloak both ship disabled in this image.

To enable LDAP, set LDAP_ENABLED=true in /var/www/deming/.env. Fill in LDAP_HOST, LDAP_PORT, the bind LDAP_USERNAME and LDAP_PASSWORD, and LDAP_BASE_DN for your directory. LDAP_FALLBACK_LOCAL=true keeps local logins working alongside it.

To enable Keycloak or generic OpenID Connect single sign-on, add keycloak (or oidc) to SOCIALITE_PROVIDERS, and fill in the matching KEYCLOAK_ (or OIDC_) values. After editing .env, clear the cached configuration:

sudo -u www-data php /var/www/deming/artisan config:clear

Deming exposes a REST API through Laravel Passport. Passport ships unprovisioned, so no OAuth keys are baked into the image. To enable the API on your instance, generate this VM's own Passport keys and client:

cd /var/www/deming
sudo -u www-data php artisan passport:install

Keep the generated keys private. Like .env, they are per-instance signing material.

Point an A record at the VM's public IP, then set APP_URL in /var/www/deming/.env to https://your.domain.

For TLS, the simplest path is a certificate from Let's Encrypt with the nginx plugin, which edits the shipped nginx site in place and reloads it. Replace <your-domain> with your fully qualified domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --redirect --agree-tos -m admin@<your-domain> -n

After certbot has installed the certificate, set APP_FORCE_HTTPS=true in .env, and clear the cache so every generated URL uses HTTPS.

The image ships no .env, no application key and no database schema, so the seeded default administrator does not exist in it. nginx and php8.4-fpm are gated on a bootstrap marker that first boot writes only after your per-instance secrets exist and the seeded administrator has been rotated. Until then, systemd skips the serving units and nothing is reachable. Run this command to inspect the gate:

grep -E 'ConditionPathExists|After=' /etc/systemd/system/nginx.service.d/sac-bootstrap-gate.conf ls -l /var/lib/sac/data/ systemctl is-enabled php8.4-fpm.service nginx.service deming-firstboot.service

The document root is the Laravel public/ directory and nothing above it, and only the front controller executes PHP. Run this command to confirm that nothing above public/ is reachable over HTTP:

grep -E '^\s+root ' /etc/nginx/sites-available/deming for p in /.env /config/app.php /vendor/autoload.php /artisan; do printf '%-28s HTTP %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' -m 10 http://127.0.0.1$p)" done curl -s -o /dev/null -w '/login HTTP %{http_code}\n' http://127.0.0.1/login

The whole state of your ISMS is in the MariaDB database plus the .env file. Take a consistent dump on a schedule, and copy it somewhere off the VM (Azure Blob Storage, for example):

TS="$(date +%F-%H%M)" DB_PASS="$(sudo sed -n 's/^deming.db.password=//p' /root/deming-credentials.txt)"
sudo mysqldump --single-transaction -u deming_user -p"$DB_PASS" deming > "/tmp/deming-$TS.sql" echo "wrote /tmp/deming-$TS.sql"

Keep a copy of /var/www/deming/.env with the backup. It holds the application key that signs your sessions and the database password, so restoring the database without it would invalidate existing sessions.

The operating system keeps itself patched through unattended upgrades. For Deming itself, SecureAnyCloud publishes refreshed images as upstream releases new versions.

The supported upgrade path is to deploy the new image and restore your database into it, which keeps the appliance hardening intact. SecureAnyCloud support can help you plan and carry out an upgrade.