ISO/IEC 27090 Readiness Checklist
ISO/IEC 27090:2026 is the first international standard addressing AI security threats — the poisoning, evasion, inversion, membership inference, model theft and prompt/output injection risks that conventional controls were never designed for. It is guidance, not a certifiable standard, and it complements ISO/IEC 42001 (AI management) and ISO/IEC 27001 (information security). Work through a checklist across six themes — governance & scope, AI-specific threat identification, controls mapping & implementation, AI asset & data inventory, monitoring, testing & assurance and documentation & continual improvement — and get a banded 0–100 readiness score, a radar of where you are strong and weak, and the gaps ranked so you fix the ones that matter most first. The weighting is a transparent heuristic, nothing is uploaded, and the result is shareable by permalink. This is an educational self-assessment, not an official ISO tool.
AI-specific security threats are largely unaddressed: no clear owner, no AI threats in the risk register, and conventional controls not yet mapped to AI risks. Start with the foundations — name an owner, enumerate the AI threats, and build an AI inventory — before worrying about assurance depth.
Readiness per theme (0–100)
Prioritised gaps
Highest-weight, lowest-scoring themes first — spend remediation effort here.
- AI-specific threat identification · unanswered
Enumerate the AI-specific threats (poisoning, evasion, inversion, membership inference, model theft, prompt/output injection) for your systems so none is an unexamined blind spot.
Reference: AI threat catalogue
- AI-specific threat identification · unanswered
Put each AI threat in the risk register with an owner, so it is tracked and treated like any other risk rather than noted and forgotten.
- Controls mapping & implementation · unanswered
Map the guidance onto your existing control set (27001 Annex A, 42001 controls) so it becomes specific, owned requirements instead of principles.
Reference: controls mapping
- Controls mapping & implementation · unanswered
Place controls across the whole AI lifecycle; a model is exposed long before and after it goes live, not just in production.
- Governance & scope · unanswered
Name an owner accountable for AI security and get leadership to recognise it as a distinct concern, so the guidance has somewhere to land.
- Governance & scope · unanswered
Frame 27090 as guidance that extends your existing 42001 / 27001 work on AI security, rather than expecting to "certify to 27090" — you cannot.
Reference: ISO/IEC 42001 & 27001
- Monitoring, testing & assurance · unanswered
Test AI systems against their threats — adversarial, robustness and output evaluation — so controls are proven, not presumed.
- AI asset & data inventory · unanswered
Build an inventory of AI systems, models and their data/pipelines — an AI BOM — so threats and controls have a known set of assets to apply to.
Reference: AI BOM
+ 16 more gaps in the full export.
Governance & scope · weight 18
ISO/IEC 27090 is guidance that sits alongside ISO/IEC 42001 (AI management) and ISO/IEC 27001 (information security). Readiness starts with owning AI security, knowing how the guidance relates to your management systems, and defining which AI is in scope.
Leadership treats AI security as a distinct concern and there is a named owner accountable for it across the organisation.
You understand that ISO/IEC 27090 is guidance that complements ISO/IEC 42001 and ISO/IEC 27001 — it is not a separate certifiable standard.
The scope of AI systems in use — built in-house, bought, or embedded in SaaS and products — is defined, so the guidance has a known boundary.
AI security is integrated into existing governance (risk committee, policy, assurance) rather than run as a disconnected side project.
AI-specific threat identification · weight 20
The reason the standard exists: AI introduces threats conventional controls do not cover — data poisoning, evasion, model inversion, membership inference, model theft and prompt/output injection. Readiness is whether these are named, owned and in your risk register.
The AI-specific threats in scope are identified — data poisoning, evasion / adversarial examples, model inversion, membership inference, model theft / extraction, and prompt / output injection.
Each identified AI threat has an owner and sits in your risk register alongside conventional risks, not in a separate informal list.
You distinguish threats TO the AI (poisoning, theft) from threats FROM the AI (unsafe or manipulated outputs) and address both.
Supply-chain AI threats — third-party models, datasets, pre-trained weights and AI-enabled dependencies — are considered, not just in-house models.
Controls mapping & implementation · weight 20
Guidance only reduces risk once it becomes controls you actually run. Readiness is whether 27090's guidance is mapped onto concrete controls across the AI lifecycle — and whether those controls are implemented, not just intended.
ISO/IEC 27090 guidance is mapped onto concrete controls you already operate (e.g. ISO/IEC 27001 Annex A and ISO/IEC 42001 controls) rather than treated as abstract advice.
Controls exist across the AI lifecycle — data handling, training, evaluation, deployment, monitoring and decommissioning — not only at deployment.
Controls for the highest-priority AI threats are actually implemented and owned, not only documented as intentions.
Where the guidance highlights a risk you have no control for, the gap is tracked with a remediation plan rather than quietly dropped.
AI asset & data inventory · weight 14
You cannot secure AI you cannot see. An inventory of AI systems, models and the datasets and pipelines that feed them — including third-party and embedded AI — is the substrate the threat work and controls run on.
You maintain an inventory of AI systems, models and the datasets / pipelines that feed them (an AI bill of materials).
Training and inference data sources are classified by sensitivity and provenance, so poisoning and leakage risks can be reasoned about.
Third-party and embedded AI (in SaaS and products) is inventoried, since you inherit its threats without having built it.
The inventory is refreshed on a cadence, not a one-off that goes stale as models, data and vendors change.
Monitoring, testing & assurance · weight 16
Controls have to be tested and watched. Readiness is whether AI systems are tested against the identified threats, AI-relevant events are monitored, there is an incident path for AI-specific incidents, and assurance is evidenced rather than assumed.
AI systems are tested against the identified threats (adversarial / robustness testing, red-teaming, evaluation of model outputs).
AI-relevant events are logged and monitored so a poisoning, extraction or manipulation attempt can be detected.
There is an incident-response path for AI-specific incidents (model compromise, harmful output, data exposure through the model).
Assurance is evidenced — results of testing and monitoring are recorded so readiness can be demonstrated, not just claimed.
Documentation & continual improvement · weight 12
AI security is not a one-time project. Readiness is whether decisions are documented, the posture is reviewed on a cadence and after significant changes, lessons feed back into controls, and the people building AI understand the guidance relevant to their role.
AI-security decisions, risk assessments and control choices are documented so they can be reviewed and audited.
The AI-security posture is reviewed on a defined cadence and after significant changes (a new model, data source or use case).
Lessons from incidents and testing feed back into controls, the risk register and the AI inventory.
People who build and operate AI understand the AI-security guidance relevant to their role.
Heuristic readiness self-assessment. ISO/IEC 27090:2026 is guidance on AI security threats, not a certifiable standard — it complements ISO/IEC 42001 and ISO/IEC 27001, and its normative text is available only from the official ISO catalogue and is not reproduced here. This is not an audit, certification or legal advice; the dimension weights are a transparent judgement framework for structured self-reflection, not a measurement or guarantee of outcome. PlayCISO is not affiliated with ISO or IEC. This tool performs no scan and runs entirely in your browser — nothing is uploaded. Your answers are stored only in the shareable link you choose to copy.
What this checklist is
- A free, 100% in-browser readiness self-assessment for ISO/IEC 27090:2026 — the first international standard addressing AI security threats. Answer a weighted checklist across the standard's themes and get a banded 0–100 readiness score.
- Six weighted themes: governance & scope, AI-specific threat identification, controls mapping & implementation, AI asset & data inventory, monitoring/testing/assurance, and documentation & continual improvement.
- ISO/IEC 27090 is GUIDANCE, not a certifiable standard — you cannot be "27090 certified". It complements ISO/IEC 42001 (AI management systems) and ISO/IEC 27001 (information security). This tool makes that relationship explicit.
- Every item maps to a concrete next action, and the gaps are prioritised lowest-score, highest-weight first — so naming the AI threats and mapping the guidance onto real controls gets attention first.
- Educational self-assessment, not an audit or legal advice, and not an official ISO tool. Nothing is uploaded — export to Markdown or CSV, and share the exact checklist with a base64url permalink.
A standard only reduces risk once it becomes controls you run
ISO/IEC 27090 matters because it names the threats that are specific to AI — attacks on models like data poisoning and model theft, and risks from models like manipulated or unsafe outputs — and gives guidance on addressing them. But a standard that stays on the shelf changes nothing. Readiness is whether those AI threats are named, owned and sitting in your risk register, whether the guidance is mapped onto concrete controls across the AI lifecycle, and whether you can see the AI you are trying to secure through an up-to-date inventory. Because 27090 is guidance that complements ISO/IEC 42001 and 27001, the practical move is to extend the controls you already run — not to build a separate programme.
The six themes are weighted on purpose — threat identification and controls mapping carry the most, because they are where abstract guidance turns into reduced risk. That weighting is a heuristic, shown openly so you can argue with it and adjust it to your own environment. This is an educational self-assessment, not an audit, a certification or legal advice, and it does not reproduce the standard — the normative text is available only from the official ISO catalogue. PlayCISO is not affiliated with ISO or IEC, and this tool quotes no invented statistics.
Frequently asked questions
What is ISO/IEC 27090?
ISO/IEC 27090:2026 is the first international standard specifically addressing AI security threats. It provides guidance for organisations on how to identify and address security threats and failures that are specific to AI systems — such as data poisoning, adversarial/evasion attacks, model inversion, membership inference, model theft and prompt/output injection — which conventional information-security controls were not designed to cover. It is positioned to complement ISO/IEC 42001 (AI management systems) and ISO/IEC 27001 (information security management), extending them to the AI-specific threat landscape rather than replacing them.
Is ISO/IEC 27090 certifiable? Can I get "27090 certified"?
No. ISO/IEC 27090 is guidance, not a certifiable management-system standard. You can certify an information security management system against ISO/IEC 27001 and an AI management system against ISO/IEC 42001, but there is no certification against 27090 — it is guidance you use to strengthen the AI-security dimension of those systems and your wider programme. This readiness checklist reflects that: it scores how well you have taken up the guidance, and it is explicitly not an audit, a certification or a guarantee of compliance.
Where do I get the ISO 27090 PDF / full text?
The full normative text is a copyrighted ISO/IEC document and is not freely available — and it is not reproduced in this tool. You buy it from the official ISO catalogue at iso.org (search for ISO/IEC 27090), or from an authorised national standards body (such as BSI, ANSI or DIN) that resells ISO standards. Beware of sites offering a "free ISO 27090 PDF download" — they are typically unauthorised copies. Our blog post on ISO/IEC 27090 and what a CISO should do about it (/blog/iso-iec-27090-ai-security-standard-what-ciso-should-do) links the official source and explains the practical steps; this checklist turns those steps into a scored self-assessment you can run without the document in hand.
How does 27090 relate to ISO/IEC 42001 and 27001?
Think of them as layers. ISO/IEC 27001 governs information security management in general. ISO/IEC 42001 governs the management of AI systems (an AI management system). ISO/IEC 27090 provides the AI-security threat guidance that both need to be credible about AI risk — the specific threats to and from AI models and the controls that address them. In practice you map 27090's guidance onto the controls you already run under 27001 (e.g. Annex A) and 42001, rather than standing up a separate programme. This checklist's governance and controls-mapping themes are built around exactly that.
Does it scan anything or send my answers anywhere?
No. The checklist runs entirely in your browser. It performs no scan and touches no system. Your answers are never uploaded — they live only in the shareable permalink you choose to copy (encoded in the URL) and in any Markdown or CSV file you export yourself. It is an educational self-assessment and not affiliated with ISO or IEC.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.