ISO 27001

What it requires

ISO 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). For AI systems, the security controls in Annex A are particularly relevant to protecting model integrity, training data, inference pipelines, and deployment infrastructure.

Key Annex A controls for AI

• A.5: Organisational controls (policies, roles, segregation of duties, threat intelligence)
• A.6: People controls (screening, awareness, responsibilities after termination)
• A.7: Physical controls (security perimeters, equipment, secure disposal)
• A.8: Technological controls (access control, authentication, cryptography, logging, monitoring, secure development, data masking)

How Vigilens automates it

Vigilens selects the Annex A controls most relevant to AI system security and maps them to evidence available in your engineering tools. The focus is on controls that protect model integrity, data pipelines, and deployment infrastructure.

• AI-relevant Annex A controls with acceptance specifications tied to pipeline evidence
• Shared ISMS structure with ISO 42001 (both follow Annex SL high-level structure)
• Security evidence from GitHub/GitLab (branch protection, code review, secrets scanning)
• Deployment security evidence from CI/CD logs, container scanning, infrastructure configs
• Cross-mapped to EU AI Act Article 15 (cybersecurity requirements)

ISO 27001 and AI governance

AI systems introduce novel information security risks: adversarial attacks on models, data poisoning, model extraction, and prompt injection. ISO 27001 provides the security management foundation, while ISO 42001 and the EU AI Act address AI-specific governance. Vigilens covers all three in a single pipeline.