ISO/IEC 27090 Project Plan Template
An editable project plan for applying ISO/IEC 27090 guidance: seven phases with tasks, Responsible and Accountable owners, deliverables, exit criteria and indicative durations. Track status and target dates and export the plan.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Subscribers customise it with their own details and generate the document for their own work.
Plan preview: phases, owners and deliverables
Durations are indicative planning figures, not a benchmark. The full template adds tasks with Responsible and Accountable owners, status and target dates.
| Phase | Indicative duration (weeks) | Phase owner | Deliverables | Exit criterion |
|---|---|---|---|---|
| Mobilise | 2 | Executive sponsor | Project charter and budget; Named AI security owner; Steering group terms of reference | Charter and budget signed; AI security owner named; steering group has met. |
| Scope and inventory | 3 | CISO / AI security lead | AI security scope statement; AI system inventory / AI bill of materials; Provider vs deployer role per system | Scope statement approved; every in-scope AI system is in the inventory with an owner. |
| Threat assessment | 4 | GRC / risk lead | AI asset and threat register; Risk register entries for AI threats; Threat model per high-risk AI system | Every in-scope system has a threat model; every AI threat is in the risk register with an owner. |
| Control design | 4 | CISO / AI security lead | AI risk treatment plan; AI security policy; Control mapping to 27001 Annex A and/or 42001 Annex A; RACI for AI security | Risk treatment plan and AI security policy approved; residual risk accepted in writing. |
| Implementation | 8 | CISO / AI security lead | Implemented controls with owners; AI logging and monitoring; AI incident response playbook; Supplier clauses for AI vendors | Controls for the top-rated threats are live; AI events reach monitoring; IR plan covers AI incidents. |
| Testing and evidence | 4 | CISO / AI security lead | AI security test plan and results; Testing evidence log; Findings with retest status | Each system tested against its threats; critical findings fixed and retested; evidence log complete. |
| Review and improve | 2 | Executive sponsor | Management review minutes and actions; Internal audit or independent review report; Next-cycle plan | Management review held; actions owned; next cycle and re-assessment triggers agreed. |
Customise it with your organisation’s details and download it as Word, PDF, Markdown or CSV with Pro.
An editable project plan for applying ISO/IEC 27090 guidance: seven phases (mobilise, scope and inventory, threat assessment, control design, implementation, testing and evidence, review and improve) with tasks, Responsible and Accountable owners, deliverables, exit criteria and indicative durations. The sample assumes an organisation that already runs an ISO/IEC 27001 ISMS. Track status and target dates, then export the plan.
Your context
Assumptions and constraints
Phases
One row per phase. Durations are indicative.
Tasks
Tasks per phase with the Responsible and Accountable roles. Add the outputs and target dates for your organisation.
Loading…
TL;DRWhat this template gives you
4 points
- The same seven phases as the ISO 27090 project plan generator, as a document you can edit line by line, track and export.
- Every task carries a Responsible and an Accountable role; every phase has deliverables and an exit criterion.
- Durations are indicative planning figures, not a benchmark. The summary adds them up and gives an indicative finish date from your start date.
- ISO/IEC 27090 is guidance: the plan ends in a management review and, if you want a certificate, an ISO/IEC 27001 or 42001 audit, never a "27090 certificate".
Frequently asked questions
How is this different from the ISO 27090 project plan generator?
The generator scales phase durations to your size, number of AI systems and existing certifications and draws a timeline. This template is the editable plan document: change tasks, owners, outputs, statuses and dates, then export it for the steering group.
How long does ISO/IEC 27090 adoption take?
It depends on the number of AI systems, how much an existing ISO/IEC 27001 or 42001 system can be reused, and the people available. The sample phase durations add up to about 27 weeks if run one after another; overlap shortens that. Treat it as a starting estimate, not a benchmark.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. A free account gets 3 free tool runs, shared across every tool; after that, customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) needs Pro, $5/month or $40/year. Your work is saved in your own browser.
ISO 27090 toolkit
Explore all AI & ISO standards →Everything on PlayCISO for ISO/IEC 27090, from the first self-check to the auditor’s questions. ISO/IEC 27090 is guidance, not a certifiable standard.
ISO 27090 Readiness Checklist
Reference · GuideCan you be certified to ISO 27090?
Planner · ProISO 27090 Project Plan
Roadmap · ProISO 27090 Maturity Timeline
Templates · ProISO 27090 Sample Artefacts
Lab · ProISO 27090 Implementation Lab
Lab · ProISO 27090 Threat-Mapping Lab
Template · ProISO 27090 AI Security Test Plan
Template · ProISO 27090 RACI Template
Matrix · FreeISO 27090 Traceability Matrix
Generator · FreeISO 27090 Alignment Statement
Labs · FreeISO 27090 Practice Path
Matrix · FreeAI Shared-Responsibility Matrix
Briefing · FreeAI Security Board Briefing Pack
Metrics · FreeAI Security Metrics Set
Estimator · FreeISO 27090 Cost Estimator
Calendar · FreeAI Security Review Calendar
Course · FreeISO 27090 in 10 Minutes
Simulator · FreeISO 27090 Auditor Interview
Article · GuideISO 27090 explained
ISO 42001 tools
AI standards toolkit →Every ISO tool on PlayCISO, grouped by the standard it supports. Standards are described in our own words; you still need your own copies of them.
ISO/IEC 42001: AI management system
The certifiable AI management system standard: clauses 4 to 10 plus Annex A controls, audited by an accredited certification body.
- ISO 42001 AIMS Scope BuilderFreeClause 4: context, interested parties and a draft scope.
- ISO 42001 Gap Assessment LabProPractise judging conformity against the AIMS standard.
- ISO 42001 RACI TemplateProTen roles × clauses 4–10 and Annex A areas A.2–A.10.
- ISO 42001 Implementation Project PlanProScope to Stage 2: phases, tasks, owners and indicative durations.
- ISO 42001 Annex A GuideFreeA.2 to A.10: what good looks like and audit evidence.
- ISO 42001 SoA BuilderProStatement of Applicability with status and justification.
- ISO 42001 Objectives PlannerFreeMeasurable AI objectives with owners and KPIs.
- ISO 42001 AI Competence MatrixFreeClauses 7.2 and 7.3: roles, target levels and gaps.
- ISO 42001 Documented Information RegisterFreeEvery AIMS document and record with owner and retention.
- ISO 42001 Evidence BinderProAudit evidence by clause and Annex A area.
- ISO 42001 Internal Audit PlannerFree9.2: a risk-based 12-month audit programme.
- ISO 42001 Management Review PackPro9.3: every input, KPIs, decisions and actions.
- ISO 42001 Nonconformity TrackerFree10.2: root cause, corrective action, effectiveness.
- ISO 42001 Mock AuditProRehearse the certification audit and get a debrief.
- ISO 42001 Stage 2 Audit LabFreeThree audit days with a certification auditor.
- ISO 42001 Certification CountdownFreePlan back from your certificate date.
- ISO 42001 + 27001 IMS PlannerFreeWhat an AIMS and an ISMS can share or merge.
Across standards
Implement a control once and evidence it for every framework that asks for it.
- AI Standards CrosswalkPro42001, 27001, 27090, EU AI Act and NIST AI RMF side by side.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.