ISO 27090 Project Plan Generator

It depends on how many AI systems are in scope and what you already have. As a planning heuristic, a mid-size organisation with a handful of AI systems and an existing ISO/IEC 27001 ISMS is looking at roughly five to six months from mobilisation to the first management review; without 27001 or 42001, or with dozens of AI systems, it takes longer. These are indicative figures for planning, not a benchmark: use the generator to see how your inputs change it.

No, because there is no such thing. ISO/IEC 27090 is guidance on addressing security threats and compromises to AI systems; it has no certifiable requirements. The plan ends with a management review and, if you want an auditable certificate, a step to plan an ISO/IEC 27001 (information security) or ISO/IEC 42001 (AI management system) audit with an accredited certification body.

Because you reuse what they already gave you. A 27001 ISMS brings a risk assessment method, a risk register, a Statement of Applicability and an internal audit programme. A 42001 AIMS brings an AI system inventory, AI impact assessments and an AI-focused management review. ISO/IEC 27090 guidance plugs into those rather than replacing them, so mobilisation, scoping and control design move faster.

Seven: mobilise (sponsor, owner, budget), scope and inventory (which AI systems, an AI bill of materials, provider or deployer role), threat assessment (AI-specific threats mapped to confidentiality, integrity and availability, into the risk register), control design (risk treatment, policy, mapping to Annex A), implementation (controls, monitoring, incident response, supplier terms), testing and evidence (adversarial testing, retests, an evidence log) and review and improve (internal audit, management review, next cycle).

No. The plan is computed in your browser from the inputs you enter, and the Markdown and CSV exports are created on your device.