ISO 27090 Maturity Timeline
Most organisations move through five levels of AI security maturity: Initial, Aware, Defined, Managed and Optimising. Tell us where you are, where you want to be and what you already have, and see the indicative months for each step, what each level looks like across six themes, and what has to be true to move up.
Guidance only. Indicative timelines, not a certification path or a commitment. ISO/IEC 27090 is guidance and defines no maturity levels; it cannot be certified. These five levels and the time between them are PlayCISO's own planning heuristic for a conversation about pace, not a benchmark, an audit result or a promise. Real timelines depend on your people, systems, suppliers and risk appetite.
Where you are and where you want to be
Indicative timeline: about 10–19 months
Solid bar: the faster end of the range. Faded bar: the slower end. Ranges widen as you go up, because later levels need several review cycles of evidence, which takes calendar time whatever the budget.
Level 1
Initial
AI is in use but AI security is ad hoc: no owner, no inventory, AI threats not in the risk register.
- Governance & scope: No named owner; AI security handled case by case.
- Threat identification: AI-specific threats are not named.
- Controls: Generic IT controls only.
- AI inventory: Nobody can list the AI systems in use.
- Testing & monitoring: No AI-specific testing or monitoring.
- Review & improvement: No review; lessons are not captured.
To move up: A named owner for AI security; A first AI inventory, even if incomplete; Leadership agrees AI security is in scope of the ISMS or AIMS.
Level 2 · you
Aware
There is an owner and a first inventory. AI threats are being named, but controls and testing are patchy.
- Governance & scope: Owner named; scope drafted.
- Threat identification: The main AI threat themes are listed for the riskiest systems.
- Controls: Some quick wins: output encoding, rate limits, access to model artefacts.
- AI inventory: Inventory of in-house AI; third-party and embedded AI partly covered.
- Testing & monitoring: Occasional testing, often by the vendor.
- Review & improvement: Issues fixed as they arise.
To move up: Scope statement approved; Every in-scope AI threat is in the risk register with an owner; AI security policy approved.
Level 3
Defined
Scope, policy, threat register and risk treatment exist and are approved. Controls are designed across the life cycle.
- Governance & scope: Approved scope and policy; RACI agreed; aligned with 27001 / 42001.
- Threat identification: Threat register for every in-scope system, mapped to CIA, including supply chain.
- Controls: Risk treatment plan with controls across data, training, deployment and monitoring.
- AI inventory: AI bill of materials covering built, bought and embedded AI.
- Testing & monitoring: Test plan per system; findings logged.
- Review & improvement: Management review includes AI security.
To move up: Controls for top risks implemented, not just designed; Adversarial testing done and findings retested; An evidence log an auditor could sample.
Level 4 · target
Managed
Controls run, are tested and monitored, and the evidence is kept. AI incidents have a defined path.
- Governance & scope: AI security reported to leadership on a cadence.
- Threat identification: Register updated on every significant AI change.
- Controls: Controls implemented with owners; supplier terms in contracts.
- AI inventory: Inventory refreshed on a schedule and on change.
- Testing & monitoring: Regular adversarial testing, monitoring of AI events, AI incident playbook exercised.
- Review & improvement: Metrics tracked; internal audit covers AI security.
To move up: Metrics show trends over several cycles; Lessons from tests and incidents demonstrably change controls; Independent review or audit has sampled the evidence.
Level 5
Optimising
AI security improves continuously from measured results, and is built into how AI is designed and bought.
- Governance & scope: AI security is part of AI product and procurement decisions by default.
- Threat identification: Threat intelligence on AI attacks feeds the register.
- Controls: Controls tuned from metrics, with the accuracy trade-offs measured.
- AI inventory: Inventory largely automated from pipelines and procurement.
- Testing & monitoring: Continuous testing in the release pipeline; red-team exercises.
- Review & improvement: Improvement driven by data; shared with peers and suppliers.
Loading…
ISO 27090 toolkit
Explore all AI & ISO standards →Everything on PlayCISO for ISO/IEC 27090, from the first self-check to the auditor’s questions. ISO/IEC 27090 is guidance, not a certifiable standard.
ISO 27090 Readiness Checklist
Reference · GuideCan you be certified to ISO 27090?
Planner · ProISO 27090 Project Plan
Templates · ProISO 27090 Sample Artefacts
Lab · ProISO 27090 Implementation Lab
Lab · ProISO 27090 Threat-Mapping Lab
Template · ProISO 27090 AI Security Test Plan
Template · ProISO 27090 RACI Template
Template · ProISO 27090 Project Plan Template
Matrix · FreeISO 27090 Traceability Matrix
Generator · FreeISO 27090 Alignment Statement
Labs · FreeISO 27090 Practice Path
Matrix · FreeAI Shared-Responsibility Matrix
Briefing · FreeAI Security Board Briefing Pack
Metrics · FreeAI Security Metrics Set
Estimator · FreeISO 27090 Cost Estimator
Calendar · FreeAI Security Review Calendar
Course · FreeISO 27090 in 10 Minutes
Simulator · FreeISO 27090 Auditor Interview
Article · GuideISO 27090 explained
TL;DRWhat this timeline is
4 points
- Five levels of AI security maturity, informed by ISO/IEC 27090 guidance: Initial, Aware, Defined, Managed and Optimising, each described across six themes with what has to be true to move up.
- Pick your current and target level, organisation size, number of AI systems, staffing and whether you hold ISO/IEC 27001 or 42001, and see an indicative range of months for each step.
- Guidance only. ISO/IEC 27090 defines no maturity levels and cannot be certified. The levels and timings are PlayCISO's planning heuristic, not a certification path or a commitment.
- Export the timeline to Markdown or CSV; the guidance-only note goes with it.
Frequently asked questions
Does ISO/IEC 27090 have maturity levels?
No. ISO/IEC 27090 is guidance on addressing security threats and compromises to AI systems; it does not define maturity levels or a scoring scheme. The five levels here are PlayCISO's own model, built on the themes the guidance covers (governance and scope, AI-specific threats, controls, inventory, testing and monitoring, improvement), to help you plan and explain pace.
How long does it take to reach a mature AI security posture?
Indicatively, moving from ad hoc to a defined programme (levels 1 to 3) takes many organisations somewhere between six months and a little over a year, and reaching a managed, measured level takes another year or more, because it needs several review cycles of evidence. These ranges are planning heuristics, not benchmarks: your people, number of AI systems and existing ISO/IEC 27001 or 42001 work move them a lot.
Is reaching level 5 the same as being ISO 27090 certified?
No. There is no ISO/IEC 27090 certification at any level. If you need a certificate, the routes are ISO/IEC 27001 (information security management system) and ISO/IEC 42001 (AI management system), audited by an accredited certification body. A higher maturity level makes those audits easier to pass; it does not replace them.
Why do the ranges get wider at higher levels?
Lower levels are mostly about deciding and documenting: naming an owner, an inventory, a threat register, a policy. Higher levels need controls to run, be tested, be monitored and show trends over several review cycles, which takes calendar time no matter how much budget you have.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.