Managing AI risks with ISO 27001

Typically, information security frameworks, standards and models can be seen as reactive, taking lessons from past incidents to guide organisations to protect themselves against known risks. However, the rapid development and subsequent inclusion of AI in information security processes have changed how the industry approaches risk and threat modelling. Using AI tools in threat modelling to predict and identify novel threats supports the proactive implementation of information security controls and processes that protect information assets before threats materialise.

This proactive integration of AI in information security standards represents a shift in a long-established governance, risk, and compliance strategy, demonstrating a movement away from static compliance checklists to dynamic and adaptive security postures. This approach reduces the likelihood and impact of security incidents, resulting in significant cost savings through reduced incident response costs, minimised downtime and increased operational efficiency.

This article explores how ISO/IEC 27001: 2022 can be used to address AI-related risks and strengthen information security management.

ISO/IEC 27001 and ISO 27002: 2022

ISO 27001: 2022 is an international standard that provides organisations with a framework for managing information security risks through the establishment, implementation, maintenance and continuous improvement of an information security management system (ISMS). ISO/IEC 27002 provides additional guidance for the implementation of controls in an ISMS. Achieving ISO 27001 certification indicates that an organisation has implemented an ISMS that follows best practices to manage risks related to the security of the data it owns or handles.

Although the ISO/IEC 42001 standard focuses specifically on AI, it is still an emerging standard (For guidance on implementing ISO 42001, see the article by my colleague Chris Martin.) In contrast, ISO 27001 is considered here as it is widely adopted by organisations across a wide range of industries and is globally recognised as the gold standard for information security management.

ISO/IEC 27001: 2022

Clause 4.1: Context of the Organisation

Clause 4 requires organisations to identify the internal and external issues that may have an impact on their ability to achieve their information security objectives.

Recommendation: To achieve this, a PESTEL (Political, Environment, Sociological, Technological, Economic and Legal) analysis can be performed to identify relevant factors. This assessment helps organisations understand how technological advancements and emerging legislation may impact their information security strategy and ISMS. Proactively identifying relevant issues allows organisations to tailor their ISMS to ensure it addresses the specific challenges posed by AI technologies.

Clause 6: Planning

This clause requires organisations to identify risks and opportunities related to their information security objectives.

Recommendation: To support this, organisations should ensure their risk assessments include AI-related risks, such as data poisoning or adversarial attacks. Following this risk assessment, organisations should implement tailored measures and mitigations that address the unique risks posed by AI and are aligned with their risk appetite, compliance requirements and information security objectives.

Clause 7.2: Competence

Regarding people-related risks, organisations must ensure their staff are competent for their roles and possess the necessary skills and knowledge to manage AI-related risks.

Recommendation: Organisations should ensure their training and awareness programmes include some focus on AI and AI-related threats.  It’s important to equip staff with this knowledge to ensure they can effectively identify and appropriately respond to AI-related security challenges, reducing the risk of human error.

ISO/IEC 27002: 2022

Control 5.7: Threat intelligence

To effectively implement this control, organisations should ensure information relating to information security threats is collected and analysed.

Recommendation: Organisations should explore the use of AI tools to enrich existing threat intelligence methods. This will provide comprehensive coverage of attack vectors and AI-specific threats, reducing the risk of successful attacks and also improving organisations’ ability to respond to threats should they materialise.

Control 5.21 Managing information security in the ICT supply chain

Organisations should ensure that processes and procedures are defined and implemented to manage the risks associated with third-party suppliers and supply chain dependencies. This will reduce the risk of breaches originating from third-party suppliers, increasing confidence in the security of supply chain processes.

Recommendation: Implement checks to evaluate third-party suppliers’ use of AI technologies and ensure this complies with the organisations’ security standards and requirements. Organisations can also include standard information security clauses.

Control 6.3: Information security awareness, education and training

Staff and interested parties should receive adequate information security awareness training and regular updates to information security policies relevant to their role functions.

Recommendation: Develop information security training programmes that include modules on AI-related risks to educate personnel about AI-related risks, reducing the likelihood of human error and improving adherence to AI-related security policies.

Control 8.28 Secure coding

Organisations should ensure secure coding principles are used for coding and software development to ensure software is written securely, limiting risk to sensitive data and personally identifiable information.

Recommendation: Organisations should implement secure coding standards that include parameters for the use of AI tools during the development process to minimise vulnerability exposure.

Implications of Non-compliance

Achieving ISO 27001: 2022 certification and effective implementation of information security controls and best practices will enhance the resilience of the organisation, supporting the overall perception of the organisation as an information security leader. However, failing to include and address AI-specific risks under the standard may have significant implications, including:

• Regulatory Penalties: Non-compliance with AI-related regulations and legislation identified in a PESTEL analysis may result in significant fines.
• Increased Vulnerability: AI-related risks can leave organisations exposed to data breaches and other security incidents.
• Reputational Damage: Security breaches involving AI systems can negatively impact stakeholder trust and harm the organisation’s reputation.

Therefore, organisations must consider AI and the implications it may have on their effectiveness and continuous improvement of their ISMS.