[Linux-aus] Grant Application from Miguel Jacq for KEEN

[Linux Australia Website]

Your Email Address: mig at mig5.net
Project name: KEEN
Grant Type: Project Grant
Aim of the project: KEEN (the Key Evidence ENgine) is an open source project that intends to flip traditional compliance framework design on its head. Instead of being a box-ticking exercise, KEEN is designed to ingest data from a wide range of external sources. This could include Elasticsearch indices, Grafana/Loki logs, OSSEC alerts, RSS feeds, Git APIs, IMAP mailboxes, Redmine or other project management tools, Bookstack documentation, and more.
What makes KEEN different is what comes next: the user can create 'mapping' rules that associate actual raw evidence being generated by those upstream systems, to framework controls (e.g ISO27001 Annex A technical controls, SOC-2 guidelines, PCI DSS requirements, and so on).
An auditor scoping an audit to specific controls can immediately locate evidence that provides proof (rather than lip service) that activities are taking place day-to-day that are contextually related to those controls, and can sample that evidence (with redaction features) easily.
KEEN allows managing not just automated evidence ingestion streams, but the entire ISMS (Information Security Management System) such as policy/process definitions, risk (SWOT, PESTLE, CIA Triad) assessments, asset and vendor registers, access control lists, and more.
The ultimate goal of KEEN is to provide proof that the ISMS is a living breathing system in an organisation that needs to meet compliance requirements, rather than a formality. It has the naive but optimistic goal of giving auditors the answer before they ask the question, and hopefully meaning those being audited can get on with their work.
KEEN began development in early 2026 to simplify real ISO27001:2022 audits and was highly commended by both internal and external auditors as being a 'game changer' - so much so that I was urged not to open source it in order to 'monetise' it. Naturally, this convinced me that open sourcing it was an absolute must. The codebase is at https://github.com/FERCBusters/keen and is under an Apache 2.0 license.
The organisation who sponsored early development of KEEN has entered insolvency. I am hoping to keep the project sustained on my own time (whilst also having lost that client of my own, resulting in significant income loss for myself), and obviously any financial support will help me do that.
I would be quite proud to state Linux Australia as a sponsor of the project which has also seen informal (not financial) interest from the Linux Foundation as to its potential and future.
Estimated cost breakdown of the project: $480 AUD  / annum (cloud hosting costs for staging/testing environments)
$7200 AUD / annum (cloud hosting costs for https://keen.cloud which operates as a demo system supporting 10 concurrent virtual servers running 30-day seeded demo instances of KEEN to interested try-before-you-commit parties)
$30,000 AUD / annum (240 hours annum (1 hour per week x 4 weeks x 12) at $125/hr) general development of the project (labour costs)
I do not expect Linux Australia to be able to finance the entire amount (especially noting your total allowance across all grants of 30k!), but any support is highly appreciated!
Project team details: Miguel Jacq (mig at mig5.net) - https://mig5.net.
I am a sole trader Linux sysadmin consultant (full-time since 2011).
I have a long history of open source development dating from 2008 in the Drupal community (I was one of the core developers of the Aegir Hosting System, which served as inspiration for today's modern PaaS Drupal hosting systems such as Acquia and Platform.sh's). https://aegirproject.org.
I am a core developer of OnionShare (https://onionshare.org) and also consult to Freedom of the Press Foundation in the US (https://freedom.press), whose work involves developing SecureDrop and Dangerzone, both open source infosec projects.
First Name: Miguel
Last Name: Jacq
Email Address: mig at mig5.net
A statement including a willingness to provide regular project updates on the project: I am willing to provide regular project updates on new features, bug fixing, security audits and general project development.
I will be most happy to highlight Linux Australia's support in sustaining the project over any period deemed suitable to Linux Australia.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 6ad5bf9cde496.csv
Type: text/csv
Size: 4410 bytes
Desc: not available
URL: <http://lists.linux.org.au/pipermail/linux-aus/attachments/20261019/03a72d87/attachment.csv>