Pro lab · ISO/IEC 27090

ISO 27090 Implementation Lab

You are the new CISO, and the board wants AI security aligned with ISO/IEC 27090 before the next audit. In five rounds you set the scope, build the AI threat register, choose controls under a budget, pick the evidence for the auditor and answer the auditor’s questions. Each answer is scored and explained, the run is seeded so you can share it, and three difficulty levels change the budget, the distractors and the hints.

3 free runs with a free account, then Pro

Loading…

ISO 27090 toolkit

Explore all AI & ISO standards →

Everything on PlayCISO for ISO/IEC 27090, from the first self-check to the auditor’s questions. ISO/IEC 27090 is guidance, not a certifiable standard.

Self-assessment · Pro

ISO 27090 explained

TL;DR

What this lab is

5 points

A five-round scenario game: you are the CISO taking a fictional insurer, hospital group or retailer through ISO/IEC 27090 adoption.
Round 1 scope, round 2 threat assessment, round 3 controls under a budget, round 4 test evidence for the auditor, round 5 the auditor's questions.
Seeded: the seed picks the organisation, shuffles the options and sets the budget, so you can share a run. Rookie, Pro and Elite change the budget, the distractors and the hints.
Every answer is scored and explained. Your grade (S to D) and streak are kept in your browser and, when signed in, on your account.
Different from the Threat-Mapping Lab, which drills individual threat classes: this lab is about running the programme.

Frequently asked questions

What does the ISO 27090 Implementation Lab teach?

How an ISO/IEC 27090 adoption actually runs: writing a scope that includes bought and embedded AI, picking the AI-specific threats that apply and leaving out the noise, choosing targeted controls when the budget will not cover everything, presenting evidence that shows a control operating, and answering an auditor honestly, including that ISO/IEC 27090 is guidance and cannot be certified.

How is it different from the ISO 27090 Threat-Mapping Lab?

The Threat-Mapping Lab drills one skill: mapping a scenario to the right AI threat class, CIA property and mitigation. The Implementation Lab is about the programme around that skill: scope, a register, budget trade-offs, evidence and audit.

Are the organisations real?

No. Kestrel Mutual, Brightwell Health Partners and Larkspur Retail Group are fictional and use the reserved .example domain. Systems, budgets and figures are invented for the exercise.

How is the score calculated?

Each round is worth 10 points: the quality of your chosen answer in rounds 1 and 4, the weighted threats you picked minus wrong picks in round 2, the risk you covered compared with the best plan possible within the budget in round 3, and the average of three answers in round 5. The total becomes a percentage, which the shared PlayCISO grading turns into an S to D grade with a small speed bonus. You clear the lab at 70% with no round below 4.